CVE-2026-76264

Received Received - Intake

Stored Cross-Site Scripting in Splunk Enterprise via Scripted Lookup

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76264

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15. A non-admin or non-power user can create or edit scripted lookup definitions via raw configuration endpoints. The issue occurs because raw transforms configuration write paths do not check external lookup capabilities before saving scripted lookup settings.

Detection Guidance

This vulnerability can be detected by checking Splunk Enterprise versions for those below 10.4.2, 10.2.6, 10.0.10, or 9.4.15. Review raw configuration endpoints for unauthorized scripted lookup definitions created or edited by non-admin or non-power users.

Impact Analysis

An attacker with limited privileges could manipulate scripted lookups to execute unauthorized actions or access sensitive data. This could lead to data integrity issues or unauthorized information disclosure within Splunk environments.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to create or modify scripted lookup definitions. This may lead to unauthorized data access or manipulation, violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2, 10.2.6, 10.0.10, or 9.4.15 or later) to address the vulnerability. Review and restrict access to raw configuration endpoints for non-admin and non-power users.

Hi! I’m here to help you understand CVE-2026-76264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70