CVE-2026-76319: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

CVE-2026-76319 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows a low-privileged user lacking the fsh_manage capability to execute remote code through manipulation of the Federated Search bundle selection process. The root cause is the Federated Search dispatch flow's failure to enforce capability checks on caller-controlled bundle selections, enabling unauthorized access and execution. This can lead to full compromise of relevant data and impact system integrity and availability. The vulnerability is tracked as CWE-862 (Missing Authorization). The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a low-privileged user to execute arbitrary code remotely, potentially gaining unauthorized access to all relevant data and compromising system integrity and availability. This elevates the risk of data breaches, system manipulation, and denial of service within affected Splunk Enterprise deployments.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict access to Splunk Enterprise to trusted users only and review role capabilities to ensure that the fsh_manage capability is properly assigned. Consult Splunk's official documentation on Federated Search security models and role capabilities for detailed guidance.