CVE-2026-76266: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

In Splunk Enterprise versions before 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can execute commands as the Splunk Enterprise user can exploit a weakness in the Linux package maintainer script. The script trusts existing installation content during upgrades, enabling the user to inject commands that run with root privileges during the upgrade process. This vulnerability arises from improper privilege assignment and verification, creating an unintended sphere of control for the local user. Exploitation requires modification of the installation followed by a package upgrade.

Successful exploitation allows a local user with limited privileges (able to run commands as the Splunk Enterprise user) to escalate privileges to root during a package upgrade. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability affects the upgrade process and can result in arbitrary code execution with root privileges.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 and later. Users should upgrade to these versions or later to remediate the vulnerability. Until upgraded, restrict local user access to the Splunk Enterprise user account and avoid performing Linux package upgrades in environments where untrusted local users can modify the installation. Monitor vendor advisories for additional guidance.