CVE-2026-76388: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise Security

In Splunk Enterprise Security versions >=8.6 and <8.6.1, the UEBA app metadata incorrectly grants the ess_analyst role write permissions to search macros that schedule searches running with administrator privileges. This misconfiguration enables users with the ess_analyst role to alter these macros, thereby gaining unauthorized access to all relevant data and potentially compromising system integrity. The root cause is the permission settings on security-critical resources allowing unintended actors to read or modify them.

Users assigned the ess_analyst role can escalate privileges by modifying UEBA search macros that execute with administrator permissions. This can lead to unauthorized access to sensitive data and compromise of system integrity. The vulnerability does not impact availability and no known exploits are reported in the wild.

Upgrade Splunk Enterprise Security to version 8.6.1 or later where this issue is fixed. The vendor advisory indicates that versions prior to 8.6.1 are affected, so applying the official patch or update is the recommended remediation. No alternative mitigations are specified.