Security Flaw in Splunk Enterprise Affects User Roles and Data Integrity
CVE-2026-76273
4.3MEDIUM
What is CVE-2026-76273?
In earlier versions of Splunk Enterprise, a vulnerability exists that allows authenticated users with the run_collect capability to execute the collect command, which can introduce malicious content into system-level messages. This exploitation arises from the failure of the collect command to validate index names before processing. As such, users with specific permissions could inadvertently or intentionally manipulate system data. To safeguard your environment, review the necessary safeguards and roles configurations as indicated in Splunk's official documentation.
Affected Version(s)
Splunk Enterprise 10.4 < 10.4.3
Splunk Enterprise 10.2 < 10.2.7
Splunk Enterprise 10.0 < 10.0.10