CVE-2026-76345

Received Received - Intake

Remote Code Execution in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer (REST) API to write files to locations that the user account running Splunk Enterprise can write to, which could allow for remote code execution. Successful exploitation could result in access to all relevant data and could affect the integrity and availability of the Splunk deployment. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the search head cluster member bundle REST API does not enforce the expected authorization boundary and does not validate bundle paths before accepting bundle content. For more information see Using the REST API reference (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/introduction/using-the-rest-api-reference), About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), and About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/overview-of-distributed-search/about-distributed-search) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76345

EUVD

EUVD-2026-62910

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2. A user with a high-privilege role that manages search head clustering could exploit the search head cluster member bundle REST API to write files to locations writable by the Splunk Enterprise account. This could lead to remote code execution. The issue occurs because the API does not enforce proper authorization boundaries or validate bundle paths before accepting content.

Impact Analysis

Successful exploitation could allow an attacker to execute arbitrary code remotely, gaining access to all relevant data. This could compromise the integrity and availability of the Splunk deployment, potentially leading to data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Data breaches resulting from this issue could lead to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2 or later to address the vulnerability. Ensure the search head cluster member bundle REST API authorization boundary is enforced and bundle paths are validated before accepting content.

Hi! I’m here to help you understand CVE-2026-76345. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70