CVE-2026-76277

Received Received - Intake

Username Trailing Period in Splunk Enterprise

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76277

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A user with edit_user capability can create a native Splunk username ending with a period. Username validation does not reject trailing periods, causing distinct usernames to share per-user configuration data. This leads to user-management operations affecting the wrong account or failing.

Detection Guidance

To detect this vulnerability, check Splunk Enterprise versions for those below 10.4.3, 10.2.7, 10.0.10, or 9.4.15. Review user accounts for trailing periods in usernames, especially those with edit_user capability. Use Splunk CLI commands like 'splunk list user' to list users and inspect usernames for trailing periods.

Impact Analysis

This vulnerability can cause unauthorized access to user data, incorrect privilege assignments, or disruption of user-management operations. Attackers could exploit it to manipulate configurations or access sensitive information by targeting accounts with shared configurations.

Compliance Impact

This vulnerability may lead to unauthorized access or data breaches, violating compliance requirements for GDPR and HIPAA. It undermines user accountability and data integrity, potentially resulting in regulatory penalties or loss of trust.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) to address the username validation issue. Review user accounts with trailing periods in their names and remove or rename them to prevent misconfiguration.

Hi! I’m here to help you understand CVE-2026-76277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70