User and Entity Behavior Analytics Vulnerability in Splunk Enterprise Security
CVE-2026-76388

8.1HIGH

Key Information:

Vendor

Splunk
Status
Splunk Enterprise Security
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76388?

In specific versions of Splunk Enterprise Security prior to 8.6.1, an oversight within the User and Entity Behavior Analytics (UEBA) component allows users with the ess_analyst role to modify search macros used by scheduled searches. This misconfiguration grants these users elevated permissions typically reserved for administrators, potentially compromising data integrity and access controls. The UEBA app metadata unintentionally allows analyst roles to write to search macros, creating a risk of unauthorized data manipulation and access. For further details, refer to Splunk's documentation.

Affected Version(s)

Splunk Enterprise Security 8.6 < 8.6.1

References

https://advisory.splunk.com/advisories/SVD-2026-0807

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.