CVE-2026-76296 is a vulnerability in Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 where unauthorized users with roles other than 'admin' or 'power' can create, move, edit, or delete sourcetype renaming configurations in apps they do not have permission to access. This occurs because Splunk Web does not perform proper authorization checks before allowing sourcetype renaming operations.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access.
The vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests.
For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.
The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.
For more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page.
The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints.
The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.
For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.
The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.
For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.
For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.
The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.
After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service.
The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections.
For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope.
The vulnerability is possible because the Data Management Representational State Transfer (REST) API verifies the required capability but does not verify that the requested preview job belongs to the requester.
The affected Data Management REST API is available only when the Edge Processor feature is turned on. The Edge Processor feature is turned off by default.
For more information see Set up a data management control plane (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/getting-started/set-up-a-data-management-control-plane) and Getting sample data for previewing data transformations (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/working-with-pipelines/getting-sample-data-for-previewing-data-transformations) in the Splunk documentation.
CVE-2026-76286 affects Splunk MCP Server versions 1.2 up to but not including 1.2.1. The vulnerability allows a user with the mcp_tool_execute capability to run a custom API tool that sends the user's Splunk platform authentication token to a URL controlled by another user. This could enable the attacker to capture the token and impersonate the original user to access data and perform actions. The issue arises because the server does not sufficiently verify that the URL request is sent to the expected destination.
CVE-2026-76285 is a critical vulnerability in Splunk Enterprise caused by improper adherence to coding standards, categorized under CWE-710. It affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without authentication and results in high impact on confidentiality, integrity, and availability. Cisco addressed this issue through a software hardening release as part of an internal security review.
CVE-2026-76284 is a critical vulnerability in Splunk Enterprise where the product fails to ensure that structured messages or data are well-formed and that certain security properties are met before processing. This issue relates to improper neutralization of input, categorized under CWE-707. The vulnerability affects multiple versions of Splunk Enterprise prior to specific patch releases. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-76283 is a high-severity vulnerability in Splunk Enterprise involving failure or incorrect use of protection mechanisms, categorized under CWE-693. It affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability allows an attacker with low privileges to cause high confidentiality impact, low integrity impact, and low availability impact. No known exploits are reported in the wild. The vendor has released software hardening updates addressing this issue.
CVE-2026-76282 is a high-severity vulnerability in Splunk Enterprise involving improper control of a resource throughout its lifecycle. This flaw affects multiple versions of Splunk Enterprise prior to certain patch releases. The vulnerability is classified under CWE-664, indicating issues with resource management. It has a CVSS score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vulnerability was identified during Cisco's internal security review and addressed in subsequent software hardening releases.
CVE-2026-76281 is an improper access control vulnerability in Splunk Enterprise that allows unauthorized actors to access restricted resources. The issue was identified during Cisco's internal security review and affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability has a medium severity rating with a CVSS score of 5.3 and impacts confidentiality but does not affect integrity or availability.
CVE-2026-76280 affects certain versions of Splunk Enterprise and Splunk Secure Gateway. It allows authenticated users without admin roles to modify alert and mobile-device recipient data stored in App Key Value Store collections. This occurs because these collections improperly allow unrestricted write access instead of restricting it to authorized workflows. The vulnerability impacts versions prior to specific fixed releases in both Splunk Enterprise and Splunk Secure Gateway.
CVE-2026-76279 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users with the run_collect capability to write events to internal indexes beyond their configured index access. This occurs because Splunk Enterprise does not normalize whitespace in index names before enforcing index-access restrictions. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-76278 is a medium-severity vulnerability in Splunk Enterprise that affects certain versions before 10.4.3, 10.2.7, and 10.0.10. It allows users with the edit_spl2_module_permissions capability to access SPL2 module permission grants for modules they should not be authorized to view. This occurs because the affected REST API does not verify if the user has read access to the requested app before returning permission data. Versions 9.4.x are not affected.
CVE-2026-76277 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users with the edit_user capability to create native Splunk usernames ending with a period due to improper username validation. This can cause distinct usernames to share configuration data, leading to user-management operations affecting incorrect accounts or failing.