CVE-2026-76388: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise Security

CVE-2026-76388 affects Splunk Enterprise Security versions prior to 8.6.1. The vulnerability arises from improper access control in the UEBA app metadata, where the ess_analyst role is granted write permissions to search macros that should only be modifiable by administrator roles. These macros are used by scheduled searches running with administrator privileges, enabling an attacker with the ess_analyst role to escalate privileges and access all relevant data and system functions. The issue is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) and has a CVSS 3.1 score of 8.1, indicating high severity.

An attacker with the ess_analyst role can modify UEBA search macros that execute with administrator permissions, potentially gaining unauthorized access to sensitive data and compromising system integrity. This privilege escalation can lead to exposure of all relevant data accessible by these searches. There are no known exploits in the wild at this time.

A fix is available in Splunk Enterprise Security version 8.6.1 and later. Users should upgrade to version 8.6.1 or above to remediate this vulnerability. No other mitigation or workaround is indicated in the provided data.