Splunk Enterprise CVE-2026-76264

Requires a valid Splunk Enterprise account that does NOT hold the 'admin' or 'power' role; the attacker must be authenticated but under-privileged. Exploitation targets the raw transforms configuration write paths (direct configuration/REST endpoints) rather than the standard lookup management UI, which is where the external lookup capability check is correctly enforced. Limiting factors: authentication is mandatory (no anonymous access), the attacker must reach the Splunk management interface/endpoints over the network, and the affected instance must be running a version below 10.4.2 / 10.2.6 / 10.0.10 / 9.4.15. No special non-default configuration is required beyond having low-privilege users provisioned.

This is a genuine-but-moderate authorization flaw (CWE-863), not a critical priority. The vendor CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) is internally consistent with the description: exploitation is network-reachable via Splunk's REST/raw configuration endpoints (AV:N), requires low complexity (AC:L), but critically requires an already-authenticated low-privilege user (PR:L) - this is a privilege/authorization boundary bypass, not a pre-auth break. Impact is limited to integrity (I:L) with no direct confidentiality or availability loss per the vendor. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so all three exploitation-probability signals are either absent or negative - no evidence of active or widespread exploitation. The one elevating factor the raw CVSS understates is business context: scripted lookups execute scripts on the Splunk search head, so the ability to create/edit scripted lookup definitions is a plausible stepping stone toward code execution, meaning real-world impact in high-privilege Splunk deployments could exceed the I:L rating - verify the actual script-execution constraints with Splunk. Bottom line: a real vulnerability warranting patching, but prioritization below internet-facing pre-auth flaws given the required authenticated foothold and absence of exploitation signals.

An authenticated Splunk user who lacks the admin or power role (e.g., a standard analyst account) sends crafted write requests directly to the raw transforms configuration endpoints, bypassing the external lookup capability check that the normal UI/API path enforces. They create or modify a scripted lookup definition they should not be permitted to control, potentially pointing it at scripts to influence search-time behavior. No public exploit is identified at time of analysis, and the attack requires a valid pre-existing low-privilege account.