CVE-2026-76344 Splunk CVE debrief

Who should care

System administrators and security teams responsible for Splunk Enterprise instances should prioritize patching to prevent potential system integrity issues. This includes reviewing role-based user access configurations, ensuring proper monitoring of dispatch directories, and validating system integrity after patching. Vulnerability management and security teams should also review affected scope and severity to determine appropriate actions for their environments.

Technical summary

The vulnerability exists because Splunk Enterprise does not validate search identifiers before creating dispatch directories. A user without 'admin' or 'power' roles could write dispatch metadata to an arbitrary location by supplying a crafted search identifier to a REST API endpoint, affecting system integrity. This issue impacts Splunk Enterprise instances, particularly those with user roles restricted to prevent administrative actions.

Defensive priority

System administrators and security teams should prioritize patching Splunk Enterprise instances to prevent potential system integrity issues.

Recommended defensive actions

• Patch Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14
• Restrict access to REST API endpoints
• Monitor system integrity and dispatch directories
• Review role-based user access configurations
• Ensure proper monitoring of dispatch directories
• Validate system integrity after patching
• Verify affected product deployments

Evidence notes

The vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user without 'admin' or 'power' roles could write dispatch metadata to an arbitrary location by supplying a crafted search identifier to a REST API endpoint. Evidence is limited to public CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and monitor system integrity and dispatch directories.

Official resources