Privilege Escalation in Splunk Enterprise Linux Package Upgrade

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76266

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise on Linux systems running versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A local user with limited privileges could manipulate the Splunk installation and then trigger a package upgrade that runs malicious commands with root privileges. The issue occurs because the package upgrade script trusts existing Splunk files during the process.

Impact Analysis

If exploited, an attacker could gain full control of the affected Linux system by running arbitrary commands as root. This could lead to complete system compromise, data theft, or unauthorized access to sensitive information stored on the system.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) immediately to prevent exploitation. Ensure no unauthorized modifications exist in the installation directory before upgrading.

Hi! I’m here to help you understand CVE-2026-76266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70