CVE-2026-76352 Splunk CVE debrief

Who should care

Splunk Enterprise administrators, security teams, and users with access to generic configuration endpoints should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators and platforms need to review and update their systems to prevent potential exploitation. Vulnerability management and security teams should prioritize patching and monitoring for suspicious activity. Asset inventory and change management processes should also be reviewed to ensure affected systems are properly tracked and remediated. Rollback and change window procedures may need to be adjusted to accommodate emergency patches. Source tracking and monitoring can help detect potential exploitation attempts. Compensating controls, such as additional monitoring or access restrictions, may be necessary for exposed systems while remediation is scheduled and verified. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Implement compensating controls for affected systems. Monitor for suspicious scripted lookup activity. Implement compensating controls for affected systems. Review and update Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14. Restrict access to generic configuration endpoints. Monitor for suspicious scripted lookup activity. Implement compensating controls for affected systems.

Technical summary

The generic transforms configuration endpoints in Splunk Enterprise do not enforce required capabilities for creating or editing external lookup definitions, allowing users without 'admin' or 'power' roles to create or modify scripted lookups and run installed lookup scripts with the permissions of the user account running Splunk Enterprise. This could potentially allow for unauthorized data access and system compromise.

Defensive priority

High priority due to potential for unauthorized data access and system compromise.

Recommended defensive actions

• Review and update Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14
• Restrict access to generic configuration endpoints
• Monitor for suspicious scripted lookup activity
• Implement compensating controls for affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from NVD and Splunk advisory indicates vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Limited information available on exploitability and affected systems. Further verification is needed to assess the scope of the vulnerability and potential impact on systems. Defenders should review the official advisory and CVE record for more details.

Official resources