CVE-2026-76336

Received Received - Intake

SPL2 Module Deletion in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service disruption. The vulnerability does not affect Splunk Enterprise versions below 10.2. The vulnerability is possible because the SPL2 module management REST API does not sufficiently authorize and validate module deletion requests. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76336

EUVD

EUVD-2026-62901

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.2.0\|end_including=10.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2 and 10.2.6. A non-admin or non-power user can delete all SPL2 modules across all apps and users via the SPL2 module management REST API. This happens because the API lacks proper authorization and validation for deletion requests.

Detection Guidance

Check Splunk Enterprise version with: splunk version. If below 10.4.2 or 10.2.6, the system is vulnerable. Review REST API logs for unauthorized SPL2 module deletion attempts via the SPL2 module management endpoint.

Impact Analysis

It could lead to deletion of exported datasets and functions, compromise system integrity, and cause partial service disruption. Users without elevated roles could disrupt operations by removing critical SPL2 modules.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2 or 10.2.6 immediately. Restrict access to the SPL2 module management REST API to admin and power roles only. Monitor for unusual deletion activity in logs.

Hi! I’m here to help you understand CVE-2026-76336. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70