In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write… (CVE-2026-76344)

CVE-2026-76344 is a vulnerability in Splunk Enterprise that allows users without admin or power roles to write dispatch metadata to arbitrary locations on the host by supplying a crafted search identifier to a REST API endpoint. The root cause is the lack of validation of the search identifier before it is used to create a dispatch directory. This can lead to integrity issues on the host system. The vulnerability affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

An attacker with low privileges (not holding admin or power roles) can write files to arbitrary locations on the host system, potentially altering system integrity. The CVSS score of 7.7 (high severity) reflects the ease of exploitation (network attack vector, low complexity, no user interaction) and the impact on integrity with a scope change. Confidentiality and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to prevent untrusted users from accessing the vulnerable REST API endpoints or limit the ability to supply crafted search identifiers. Follow Splunk's guidance on configuring role-based user access to ensure only authorized roles have necessary permissions.