Splunk Enterprise CVE-2026-76279

Exploitation requires an authenticated Splunk Enterprise user assigned a role that (a) holds the run_collect capability and (b) has index-access restrictions limiting which indexes the role may write to - the bug only matters when such restrictions are configured. The attacker invokes the collect SPL command with an index name containing non-normalized whitespace to evade the role's index-access check. Limiting factors: a privileged role (run_collect) is mandatory, so unprivileged or externally unauthenticated attackers cannot exploit it; the impact is confined to writing events into unauthorized internal indexes (integrity), with no read/disclosure and no service disruption; environments that do not restrict index access per role, or run patched versions (10.4.3, 10.2.7, 10.0.10, 9.4.15 or later), are not affected.

This is a genuinely low-priority vulnerability despite requiring attention in high-security Splunk environments. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3 MEDIUM) is internally consistent with the description: exploitation requires an authenticated user already holding a role with the run_collect capability (PR:L), and the only impact is low integrity (I:L) - writing events to internal indexes the role should not reach, with no confidentiality (C:N) or availability (A:N) effect. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The absence of exploitation signals aligns with the low real-world severity: this is a privilege/access-control boundary bypass affecting data integrity of internal indexes, not a path to code execution or data theft. One signal worth noting: the attack requires a pre-existing privileged role (run_collect), so the realistic threat is an insider or an already-compromised privileged account rather than an external unauthenticated attacker - this contextualizes the AV:N rating, which reflects the network-accessible search interface, not unauthenticated reach. No conflicting signals were found; the main gap is the absence of EPSS data to quantify exploitation likelihood.

An authenticated Splunk user whose role grants the run_collect capability but is scoped to a limited set of indexes crafts a collect SPL command using an index name containing extra or leading/trailing whitespace. Because Splunk fails to normalize whitespace before enforcing role index-access restrictions, the command writes events into an internal index outside the role's authorized scope. No public exploit code is referenced, and exploitation requires the attacker to already possess the privileged role.