CVE-2023-46214: Splunk Enterprise unsafe XSLT sanitization enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (0.89174) make this a serious RCE risk, though it requires user interaction and is not in KEV.

What it is

Splunk Enterprise below 9.0.7 and 9.1.2 does not safely sanitize user-supplied XSLT. An attacker can upload malicious XSLT that results in remote code execution on the Splunk Enterprise instance. The flaw is an XML injection class issue (CWE-91) with a high CVSS score of 8.8.

Impact

Successful exploitation gives the attacker remote code execution on the Splunk Enterprise instance, with high impact to confidentiality, integrity and availability. This can lead to full compromise of the Splunk host and any data or credentials it holds.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), consistent with an attacker needing a user to supply or process the malicious XSLT. No specific affected interface beyond XSLT upload is described in the record.

Exploitation

The CVE is not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.89174 (99.77th percentile), indicating elevated likelihood of exploitation activity. All references are vendor advisories and detection guidance, with no public exploit tag supplied.

What to do

• Upgrade Splunk Enterprise to 9.0.7 or 9.1.2 or later as directed by the vendor advisory SVD-2023-1104.
• Restrict who can upload or supply XSLT content and review existing custom XSLT for untrusted input.
• Apply network controls so the Splunk management and web interfaces are not exposed to untrusted networks.
• Monitor the vendor advisory and detection guidance for any additional hardening steps.

Detection

• Review Splunk audit and web logs for XSLT uploads or processing of untrusted stylesheets.
• Use the vendor-provided detection searches referenced in the Splunk research advisories.
• Alert on unexpected process execution or child processes spawned by the Splunk service account.
• Monitor for anomalous file writes or configuration changes in Splunk app and configuration directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.