CVE-2026-76264 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and security teams should assess exposure and prioritize remediation to prevent potential unauthorized changes to scripted lookup definitions. They should review and update Splunk Enterprise versions, restrict access to raw configuration endpoints, and monitor for unauthorized changes.

Why it matters

CVE-2026-76264 is a medium-severity vulnerability in Splunk Enterprise that allows improper authorization through the REST API. Splunk Enterprise administrators and security teams should assess exposure and prioritize remediation to prevent potential unauthorized changes to scripted lookup definitions.

• Verification of Splunk Enterprise version and configuration is required to determine exposure
• Restricting access to raw configuration endpoints can mitigate the vulnerability
• Monitoring for unauthorized changes to scripted lookup definitions is necessary

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15. A user without 'admin' or 'power' roles can create or edit scripted lookup definitions through raw configuration endpoints due to a lack of external lookup capability checks before saving scripted lookup settings. This improper authorization through the REST API allows potential unauthorized changes to scripted lookup definitions. Verification of Splunk Enterprise version and configuration is required to determine exposure.

Defensive priority

Medium priority for Splunk Enterprise administrators and security teams

Recommended defensive actions

• Review and update Splunk Enterprise versions to 10.4.2, 10.2.6, 10.0.10, or 9.4.15
• Restrict access to raw configuration endpoints for users without 'admin' or 'power' roles
• Monitor for unauthorized changes to scripted lookup definitions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15. The vulnerability allows a user without 'admin' or 'power' roles to create or edit scripted lookup definitions through raw configuration endpoints. Verification of Splunk Enterprise version and configuration is required to determine exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.