CVE-2026-76259: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

CVE-2026-76259 is a local privilege escalation vulnerability in Splunk Enterprise for Windows where a local user can bind to the management port before the Splunk service starts. This improper handling allows the attacker to intercept authentication tokens from child processes and use them to compromise all data and system integrity available to the Splunk Enterprise user account. The root cause is the lack of exclusive address binding protections on the Windows management-port listener before service initialization.

Successful exploitation allows a local user with limited privileges to escalate access by intercepting authentication tokens, leading to full compromise of data and system integrity accessible to the Splunk Enterprise user account. This can result in unauthorized access to sensitive information and control over the Splunk service environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to Windows hosts running affected Splunk Enterprise versions to trusted administrators only.