CVE-2026-76259: splunk from 9.3.0 (inclusive), before 9.3.14 (exclusive), from 9.4.0 (inclusive), before 9.4.13 (exclusive), from…

Affected technology

splunk · from 9.3.0 (inclusive), before 9.3.14 (exclusive)
splunk

splunk · from 9.4.0 (inclusive), before 9.4.13 (exclusive)
splunk

splunk · from 10.0.0 (inclusive), before 10.0.9 (exclusive)
splunk

splunk · from 10.2.0 (inclusive), before 10.2.6 (exclusive)
splunk

splunk · from 10.4.0 (inclusive), before 10.4.2 (exclusive)
splunk

Splunk Enterprise · 10.4 to before 10.4.2, 10.2 to before 10.2.6, 10.0 to before 10.0.9, 9.4 to before 9.4.13, 9.3 to before 9.3.14
Splunk

Description’s affected range: versions below 10.4.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.