Splunk Enterprise up to 9.4.13/10.0.8/10.2.5/10.4.1 Federated Search privileges management

Summaryinfo

A vulnerability categorized as critical has been discovered in Splunk Enterprise up to 9.4.13/10.0.8/10.2.5/10.4.1. Impacted is an unknown function of the component Federated Search. Such manipulation leads to privileges management. This vulnerability is traded as CVE-2026-76319. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Splunk Enterprise up to 9.4.13/10.0.8/10.2.5/10.4.1. Affected by this issue is an unknown functionality of the component Federated Search. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Federated Search dispatch flow accepts caller-controlled bundle selection without enforcing the capability that manages federated providers and indexes. For more information see Security models for Federated Search for Splunk (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.4/run-federated-searches-across-other-splunk-deployments/service-accounts-and-security-for-federated-search-for-splunk/security-models-for-federated-search-for-splunk) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

The advisory is shared for download at advisory.splunk.com. This vulnerability is handled as CVE-2026-76319 since 08/19/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 9.4.14, 10.0.9, 10.2.6 or 10.4.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise

Version

• 9.4.0
• 9.4.1
• 9.4.2
• 9.4.3
• 9.4.4
• 9.4.5
• 9.4.6
• 9.4.7
• 9.4.8
• 9.4.9
• 9.4.10
• 9.4.11
• 9.4.12
• 9.4.13
• 10.0.0
• 10.0.1
• 10.0.2
• 10.0.3
• 10.0.4
• 10.0.5
• 10.0.6
• 10.0.7
• 10.0.8
• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.4.0
• 10.4.1

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion