EUVD-2026-94625
GHSA-9r8v-pv92-mr8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with run_collect-capable role
-
ExploitCraft collect SPL with malicious index name
-
ExecutionUnvalidated index value processed
-
ImpactAttacker content written to system-level messages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires an authenticated Splunk user assigned a role that includes the run_collect capability - this is the exact, non-default prerequisite; standard users and most restricted roles lack this capability. The attacker then invokes the collect SPL command with an attacker-controlled index name, which the command fails to validate before processing. Limiting factors: valid credentials plus the specific run_collect capability are mandatory (PR:L), no user interaction is needed (UI:N), and the only achievable effect is injecting content into system-level messages (I:L) - there is no data exfiltration or denial of service. Affected deployments are Splunk Enterprise 10.4 <10.4.3, 10.2 <10.2.7, 10.0 <10.0.10, and 9.4 <9.4.15. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) shows the only impact is a limited integrity effect (I:L) with no confidentiality or availability loss - the attacker can inject attacker-controlled content into system-level messages, not read data or crash the service. Crucially, PR:L means the attacker must already be an authenticated user holding a role with the run_collect capability, which is a non-trivial privilege barrier in a properly administered Splunk deployment. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent (low CVSS, authenticated vector, limited integrity-only impact) rather than conflicting. One note: the input Tag 'Information Disclosure' conflicts with the CVSS vector, which sets C:N and I:L - the actual impact is content injection/integrity, not disclosure; treat the tag with caution. |
| Exploit ScenarioDerived | An authenticated Splunk user who has been granted a role carrying the run_collect capability runs a crafted collect SPL command supplying a malicious index name, which is not validated before processing. The injected value is written into system-level messages on the Splunk platform instance, letting the user plant misleading or malicious content that other operators may see. No public exploit code is referenced for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Authenticated Splunk Enterprise users whose roles carry the run_collect capability can inject attacker-controlled content into system-level messages on the affected instance because the collect Search Processing Language (SPL) command fails to validate the index name before processing it. The flaw affects Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15, and is limited to a low integrity impact (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with no confidentiality or availability loss and no user interaction required. Exploitation requires valid credentials plus a role granting run_collect - a non-default prerequisite that standard or restricted roles lack - and no public exploit has been identified at time of analysis; vendor patches are available, and this is a low-priority issue despite being network-reachable.
RemediationAI
Upgrade to the vendor-released fixed versions: Splunk Enterprise 10.4.3 or later, 10.2.7 or later, 10.0.10 or later, or 9.4.15 or later, as documented in advisory SVD-2026-1001 (https://advisory.splunk.com/advisories/SVD-2026-1001). Because exploitation requires the run_collect capability, a practical compensating control is to audit roles and remove run_collect from any role that does not legitimately need to write search results back into an index - the trade-off is that users in those roles lose the collect command and any saved searches or scheduled jobs that depend on it. Keep the number of accounts holding run_collect minimal and monitor their activity, and treat any unexpected changes to system-level messages as a signal for investigation. Splunk's role and capability documentation (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) can be used to identify which roles currently grant the capability. Patch application is the only complete remediation; capability restriction solely reduces exposure and does not correct the underlying missing index-name validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-20 improper input validation within Splunk's Search Processing Language implementation. SPL is the query language Splunk analysts use to search indexed data, and the collect command is the mechanism that writes search results back into an index, normally requiring the run_collect capability granted through Splunk's role-based capability model. Because the collect command does not validate the supplied index name before using it, a user with run_collect can pass a crafted index value that is reflected into system-level messages rather than being rejected or sanitized. The affected product is identified by the CPE cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*, spanning the 10.x and 9.4 maintenance branches. Impact is confined to integrity of system-level message content (I:L); the command's failure mode does not expose indexed data, escalate privileges, or disrupt service, and the attack surface is bounded by the capability check that governs access to the command in the first place.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack is over the network via SPL (AV:N/AC:L), but requires an authenticated role with the run_collect capability (PR:L), yielding only limited message-content injection (I:L, C:N/A:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB