CVE-2026-76294
published 2026-10-21CVE-2026-76294: In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.21%
9.9th percentile
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.
The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.
For more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| splunk | splunk_enterprise | >= 10.0 < 10.0.11 | 10.0.11 |
| splunk | splunk_enterprise | >= 10.2 < 10.2.8 | 10.2.8 |
| splunk | splunk_enterprise | >= 10.4 < 10.4.4 | 10.4.4 |
| splunk | splunk_enterprise | >= 9.4 < 9.4.16 | 9.4.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 REST API privileges management
vuldb·2026-10-22·CVSS 4.3
CVE-2026-76294 [MEDIUM] Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 REST API privileges management
A vulnerability classified as problematic has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3. The impacted element is an unknown function of the component REST API. Performing a manipulation results in improper privilege management.
This vulnerability is known as CVE-2026-76294. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for
ghsa_unreviewed·2026-10-22
CVE-2026-76294 [MEDIUM] CWE-862 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.
The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.
For more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published