CVE-2026-76352: Splunk

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) and limits.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/limits.conf) in the Splunk documentation.

Affected products

• Splunk Splunk: from 9.4.0, before 9.4.14 (fixed in 9.4.14); from 10.0.0, before 10.0.9 (fixed in 10.0.9); from 10.2.0, before 10.2.6 (fixed in 10.2.6); from 10.4.0, before 10.4.2 (fixed in 10.4.2)

Published 2026-08-19. Last modified 2026-08-21.