EUVD-2026-94618
GHSA-8pcj-88pc-fvhf
Severity by source
AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Local-only (AV:L); attacker must already control the Splunk service account (PR:H); a separate root-run upgrade is required (UI:R); escalation from service account to root crosses scope (S:C) yielding full root impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in Splunk Enterprise on Linux (versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15) allows an attacker who can already run commands as the OS account running Splunk Enterprise to inject operating-system commands into installation content that a subsequent root-privileged Linux package upgrade will execute as root. The flaw is conditional: the attacker must modify the installation and then a privileged package upgrade must occur, so there is no at-will escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already be able to run commands as the OS account that runs Splunk Enterprise on Linux (PR:H), AND that an affected Splunk Enterprise Linux package upgrade subsequently be performed with root privileges AFTER the attacker modifies installation content (UI:R) - because the Linux package maintainer script trusts existing installation content during root-privileged upgrade operations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible but conditional local privilege-escalation issue (CWE-269), not a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Splunk Enterprise on Linux to 10.4.3, 10.2.7, 10.0.10, or 9.4.15 (or later) depending on your branch; see the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-1001. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Splunk Enterprise on Linux instance and record exact builds against the affected ranges (below 10.4.3, 10.2.7, 10.0.10, and 9.4.15), validate current versions with the vendor advisory since no vendor-released patch is identified at time of analysis, restrict and audit which accounts can execute commands as the Splunk service account, and tighten write permissions on Splunk installation and package staging directories to root only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today