CVE-2026-76259: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

This vulnerability in Splunk Enterprise for Windows arises from improper privilege assignment and tracking related to the management port listener. Specifically, before the Splunk Enterprise service starts, the Windows management-port listener does not apply exclusive address binding protections, allowing a local user to bind to the management port. This enables interception of authentication tokens from child processes, which can then be used to compromise all data and system integrity accessible to the Splunk Enterprise user account. The affected versions are those prior to 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14.

A local attacker with access to the Windows host can exploit this vulnerability to intercept authentication tokens and gain unauthorized access to data and system functions available to the Splunk Enterprise user account. This leads to a complete compromise of confidentiality, integrity, and availability of the affected system components.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14. Users should upgrade to these or later versions to remediate the vulnerability. No information indicates alternative mitigations or that the vulnerability is already mitigated without patching.