CVE-2026-76279

Received Received - Intake

Information Disclosure in Splunk Enterprise

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76279

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A user with a role that has the run_collect capability can exploit the collect SPL command to write events to internal indexes that are outside the index access configured for their role. This happens because Splunk Enterprise does not normalize whitespace in an index name before applying index-access restrictions.

Impact Analysis

An attacker with the right role could write data to indexes they are not supposed to access, potentially leading to unauthorized data exposure, data corruption, or bypassing security controls. This could affect data integrity and confidentiality within the Splunk environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. It may result in data breaches, improper data handling, and failure to meet data protection standards.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) to address the vulnerability. Review and restrict roles with the run_collect capability to prevent unauthorized index access.

Hi! I’m here to help you understand CVE-2026-76279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70