CVE-2026-76264

Published: Oct 7, 2026Modified: Oct 14, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: psirt@cisco.com (Secondary)

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

Affected (4)

Products: Splunk: Splunk

Splunk

1 product

Splunk

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Splunk Splunk	10.0.0 ≤ version < 10.0.10
Splunk Splunk	10.2.0 ≤ version < 10.2.6
Splunk Splunk	10.4.0 ≤ version < 10.4.2
Splunk Splunk	9.4.0 ≤ version < 9.4.15

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://advisory.splunk.com/advisories/SVD-2026-1001

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.