Splunk Enterprise CVE-2026-76260

Exploitation requires: (1) a valid authenticated Splunk Enterprise session - unauthenticated access is not possible per the PR:L CVSS vector; (2) the authenticated user's role must explicitly include the rest_properties_get capability - roles without this capability cannot reach the vulnerable endpoint; (3) network access to the Splunk REST API, typically on TCP port 8089. The capability rest_properties_get is operator-assigned and not universally present in all roles, meaning deployments that adhere to least-privilege role hygiene have materially reduced exposure. The vulnerability is constrained to confidentiality - no integrity or availability impact is possible through this flaw. Exploitation is further limited to Splunk Enterprise instances on the affected version branches (9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, 10.4.x below 10.4.2).

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately represents the threat: network-accessible, no user interaction, low-complexity, but requiring authentication with a specific role capability. The high confidentiality impact reflects that stored credentials may protect downstream databases, APIs, and cloud integrations, enabling lateral movement beyond Splunk itself. Real-world risk is sharply deployment-dependent: organizations that enforce strict least-privilege role design - assigning rest_properties_get only to administrators - have limited exposure, while environments with broadly assigned or poorly audited roles face meaningful credential leakage risk. No EPSS score was present in the available intelligence, and the CVE is not in CISA KEV, so no evidence of in-the-wild exploitation exists at time of analysis. No POC has been publicly identified. Despite the absence of active exploitation signals, the straightforward nature of the REST API call means time-to-exploit is minimal once an attacker has a valid session with the requisite capability.

An authenticated Splunk user - such as a low-privileged analyst, a service account used for monitoring integrations, or an insider threat - whose role includes rest_properties_get issues a standard GET request to the Splunk REST API properties endpoint without any additional privilege escalation. The response returns encrypted stored credentials (database passwords, API keys, integration tokens) that the user is not intended to access. With those credentials in hand, the attacker can authenticate to downstream systems - databases, cloud APIs, third-party integrations - without any further interaction with Splunk. No public exploit code has been identified, but the attack requires only a valid HTTP REST call.