CVE-2026-76315

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Splunk Enterprise via REST API

Publication date: 2026-08-19

Last updated on: 2026-08-27

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability on the Splunk platform instance. The vulnerability is possible because Splunk Web Manager Configuration evaluates manager configuration values, and the Representational State Transfer (REST) API path for manager configuration does not require the permission that normally controls manager configuration writes. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) and restmap.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/restmap.conf) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-27

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76315

EUVD

EUVD-2026-63122

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.9 (exc)
splunk	splunk	From 10.2.0 (inc) to 10.2.6 (exc)
splunk	splunk	From 10.4.0 (inc) to 10.4.2 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin user could execute arbitrary code via Splunk Web Manager Configuration. The REST API path for manager configuration lacks proper permission checks, allowing unauthorized writes to manager settings. This could lead to full data access and system compromise.

Detection Guidance

To detect this vulnerability, check the Splunk Enterprise version installed on your system. Compare it against the patched versions (10.4.2, 10.2.6, 10.0.9, or 9.4.14). Run the command 'splunk version' in the Splunk CLI to verify the version. If the version is below the required threshold, the system is vulnerable.

Impact Analysis

An attacker with minimal access could gain control over the Splunk platform, access sensitive data, and disrupt operations. This includes modifying configurations, stealing data, or causing system downtime, affecting confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance risks include fines, legal penalties, and reputational damage due to compromised sensitive information.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70