Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 Splunk Web permission

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3. This impacts an unknown function of the component Splunk Web. The manipulation leads to permission. This vulnerability is uniquely identified as CVE-2026-76296. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3. This issue affects an unknown functionality of the component Splunk Web. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is integrity, and availability. The summary by CVE is:

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations. For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.

It is possible to read the advisory at advisory.splunk.com. The identification of this vulnerability is CVE-2026-76296 since 08/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 9.4.16, 10.0.11, 10.2.8 or 10.4.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise

Version

• 9.4.0
• 9.4.1
• 9.4.2
• 9.4.3
• 9.4.4
• 9.4.5
• 9.4.6
• 9.4.7
• 9.4.8
• 9.4.9
• 9.4.10
• 9.4.11
• 9.4.12
• 9.4.13
• 9.4.14
• 9.4.15
• 10.0.0
• 10.0.1
• 10.0.2
• 10.0.3
• 10.0.4
• 10.0.5
• 10.0.6
• 10.0.7
• 10.0.8
• 10.0.9
• 10.0.10
• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.2.6
• 10.2.7
• 10.4.0
• 10.4.1
• 10.4.2
• 10.4.3

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion