Security Vulnerability in Splunk Enterprise Affecting Non-Admin Users
CVE-2026-76354

8.1HIGH

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76354?

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a vulnerability exists that allows a user without administrative privileges to exploit the system using crafted REST API requests. This can lead to unauthorized deletion or overwriting of files that are writable by the Splunk process. The issue arises in the Search Head Clustering feature, where the mechanism fails to validate replicated bundle file names or properly handle NUL bytes, potentially compromising system integrity and availability.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.2

Splunk Enterprise 10.2 < 10.2.6

Splunk Enterprise 10.0 < 10.0.9

References

https://advisory.splunk.com/advisories/SVD-2026-0801

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.