CVE-2026-76264
published 2026-10-07CVE-2026-76264: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.17%
6.4th percentile
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| splunk | splunk | >= 10.0.0 < 10.0.10 | 10.0.10 |
| splunk | splunk | >= 10.2.0 < 10.2.6 | 10.2.6 |
| splunk | splunk | >= 10.4.0 < 10.4.2 | 10.4.2 |
| splunk | splunk | >= 9.4.0 < 9.4.15 | 9.4.15 |
| splunk | splunk_enterprise | >= 10.0 < 10.0.10 | 10.0.10 |
| splunk | splunk_enterprise | >= 10.2 < 10.2.6 | 10.2.6 |
| splunk | splunk_enterprise | >= 10.4 < 10.4.2 | 10.4.2 |
| splunk | splunk_enterprise | >= 9.4 < 9.4.15 | 9.4.15 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Splunk Enterprise up to 9.4.14/10.0.9/10.2.5/10.4.1 Scripted Lookup privileges management
vuldb·2026-10-07·CVSS 4.3
CVE-2026-76264 [MEDIUM] Splunk Enterprise up to 9.4.14/10.0.9/10.2.5/10.4.1 Scripted Lookup privileges management
A vulnerability has been found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.5/10.4.1 and classified as problematic. This affects an unknown function of the component Scripted Lookup. This manipulation causes improper privilege management.
The identification of this vulnerability is CVE-2026-76264. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw confi
ghsa_unreviewed·2026-10-07
CVE-2026-76264 [MEDIUM] CWE-863 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw confi
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-07
Published