CVE-2026-76255

Received Received - Intake

Privilege Escalation via SPL Injection in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76255

EUVD

EUVD-2026-63107

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13. A non-admin or non-power user can trick another user into running arbitrary SPL commands via the Data Model Editor using the victim's permissions. The commands could access all data available to the victim and affect system integrity. The issue occurs because Splunk Web does not apply SPL safeguards for risky commands during base search execution in the Data Model Editor.

Detection Guidance

Detecting this vulnerability requires monitoring Splunk Enterprise instances for unusual SPL command execution via the Data Model Editor. Check Splunk logs for unauthorized SPL commands, especially those initiated by non-admin or non-power users. Review user activity logs for suspicious interactions with the Data Model Editor.

Impact Analysis

An attacker could exploit this to run malicious SPL commands with the permissions of a targeted user, potentially accessing sensitive data or altering system behavior. The attack requires tricking the victim into initiating a request in their browser, making it a phishing risk rather than a direct exploit.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.1, 10.2.6, 10.0.8, or 9.4.13 or later. Restrict access to the Data Model Editor for non-admin users. Monitor and audit user roles and capabilities to ensure least privilege access. Apply SPL safeguards for risky commands as per Splunk documentation.

Hi! I’m here to help you understand CVE-2026-76255. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70