In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect… (CVE-2026-76354)

CVE-2026-76354 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows users without admin or power roles to impact system integrity and availability by sending crafted REST API requests that delete or overwrite files writable by the Splunk Enterprise process on non-captain search head cluster members. The root cause is that Search Head Clustering bundle replication does not validate the name of replicated bundle files or neutralize NUL bytes before constructing the member bundle path, enabling unauthorized file manipulation.

An attacker with limited privileges (not holding admin or power roles) can affect system integrity and availability by deleting or temporarily overwriting files writable by the Splunk Enterprise process on non-captain search head cluster members. This could disrupt the normal operation of the Splunk environment, potentially causing denial of service or other operational impacts. Confidentiality is not impacted according to the CVSS vector.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, patching must be applied by the customer. No vendor advisory content was provided to confirm patch availability explicitly, but the version boundaries indicate these fixed versions. Until patched, restrict user roles to prevent untrusted users from accessing REST API endpoints that could exploit this issue.