CVE-2026-76354

Analyzed Analyzed - Analysis Complete

Path Traversal in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-search-head-clustering/about-search-head-clustering), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Secure Splunk Enterprise service accounts (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/install-splunk-enterprise-securely/secure-splunk-enterprise-service-accounts) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76354

EUVD

EUVD-2026-62919

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.9 (exc)
splunk	splunk	From 10.2.0 (inc) to 10.2.6 (exc)
splunk	splunk	From 10.4.0 (inc) to 10.4.2 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin or non-power user can send a crafted REST API request to delete or overwrite files writable by the Splunk process account on a non-captain search head cluster member. The issue occurs because Search Head Clustering bundle replication fails to validate bundle file names or neutralize NUL bytes in paths.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions and monitoring for unusual file deletion or modification activities. Verify installed versions using Splunk commands like 'splunk version' or check system logs for unauthorized REST API requests. Look for unexpected bundle replication errors or file changes in Splunk's directories.

Impact Analysis

An attacker with low-privilege access could disrupt Splunk operations by deleting critical files or overwriting them, leading to system instability or downtime. This could affect data availability and integrity for all users relying on the Splunk instance.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized file deletion or modification on non-captain search head cluster members. Unauthorized file changes may lead to data integrity issues, unauthorized access, or service disruption, which are critical concerns under GDPR's data integrity principles and HIPAA's security rule requirements for protecting electronic protected health information.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability. Ensure the Splunk service account has minimal necessary permissions and does not have write access to critical system files.

Hi! I’m here to help you understand CVE-2026-76354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70