CVEFinder.io

CVE-2026-76255

🔶 medium
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands w

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Score
6.4
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 39.8% of all 349,016 vulnerabilities in our database.

#210,037
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 20, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-08-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE IDs (Weakness Types)
CWE-862

📦 Affected Products 4

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.8
splunk splunk Affected
> 10.2.0 < 10.2.6
splunk splunk Affected
> 9.4.0 < 9.4.13
splunk splunk Affected
v10.4.0

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0801
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-76251 ⚠️ high 7.1 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk r... 2026-08-19
CVE-2026-76252 🔶 medium 6.8 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user ... 2026-08-19
CVE-2026-76253 ⚠️ high 8.8 0.4 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_searc... 2026-08-19
CVE-2026-76254 ⚠️ high 7.5 0.3 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause anot... 2026-08-19
CVE-2026-76256 🔶 medium 4.3 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9,... 2026-08-19
CVE-2026-76257 🔶 medium 6.5 0.3 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10... 2026-08-19
These CVEs affect the same products