In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a… (CVE-2026-76353)

CVE-2026-76353 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to submit specially crafted knowledge bundle deltas that delete arbitrary files accessible to the cluster manager. The root cause is insufficient path restriction during knowledge bundle delta processing and missing enforcement of authorization boundaries on the endpoint. This vulnerability compromises system integrity and can cause service disruption.

An attacker with non-admin and non-power Splunk roles can delete arbitrary files on the cluster manager, potentially affecting system integrity and causing denial of service by disrupting Splunk Enterprise operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to prevent unauthorized submission of knowledge bundle deltas and monitor for suspicious activity related to knowledge bundle replication.