This vulnerability arises from improper input validation in Splunk Enterprise and certain Splunk Cloud Platform versions, allowing users with 'edit_user' privileges to create usernames containing null bytes or non-UTF-8 percent-encoded bytes. This causes inconsistent conversion of usernames, leading to account management issues such as inability to edit or delete these user accounts. The issue affects multiple versions of Splunk Enterprise below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and corresponding versions of Splunk Cloud Platform. The CVSS 3.1 base score is 6.6 with network attack vector, high privileges required, and high impact on confidentiality, integrity, and availability. The vendor has not provided explicit patch or remediation details in the available data.

The vulnerability can cause account management inconsistencies by preventing modification or deletion of user accounts with specially crafted usernames. This could disrupt administrative operations and potentially affect system integrity and availability due to inability to manage user accounts properly. The CVSS score reflects a medium severity impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the 'edit_user' capability to trusted administrators only to minimize risk. Monitor for any updates from Splunk regarding patches or workarounds addressing this input validation issue.