PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76344 Splunk CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T22:17:19.150Z and has not been modified since then. This vulnerability affects Splunk Enterprise instances, particularly those with user roles restricted to prevent administrative actions. A user without 'admin' or 'power' roles could write dispatch metadata to an arbitrary location by supplying a crafted search identifier to a REST API endpoint, affecting system integrity. The vulnerability exists because Splunk Enterprise does not validate search identifiers before creating dispatch directories. System administrators and security teams should prioritize patching to prevent potential system integrity issues.

Vendor
Splunk
Product
Splunk Enterprise
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-26
Advisory published
2026-08-19
Advisory updated
2026-08-26

Who should care

System administrators and security teams responsible for Splunk Enterprise instances should prioritize patching to prevent potential system integrity issues. This includes reviewing role-based user access configurations, ensuring proper monitoring of dispatch directories, and validating system integrity after patching. Vulnerability management and security teams should also review affected scope and severity to determine appropriate actions for their environments.

Technical summary

The vulnerability exists because Splunk Enterprise does not validate search identifiers before creating dispatch directories. A user without 'admin' or 'power' roles could write dispatch metadata to an arbitrary location by supplying a crafted search identifier to a REST API endpoint, affecting system integrity. This issue impacts Splunk Enterprise instances, particularly those with user roles restricted to prevent administrative actions.

Defensive priority

System administrators and security teams should prioritize patching Splunk Enterprise instances to prevent potential system integrity issues.

Recommended defensive actions

  • Patch Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14
  • Restrict access to REST API endpoints
  • Monitor system integrity and dispatch directories
  • Review role-based user access configurations
  • Ensure proper monitoring of dispatch directories
  • Validate system integrity after patching
  • Verify affected product deployments

Evidence notes

The vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user without 'admin' or 'power' roles could write dispatch metadata to an arbitrary location by supplying a crafted search identifier to a REST API endpoint. Evidence is limited to public CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and monitor system integrity and dispatch directories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-76344 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-76344

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-76344 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76344

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.