EUVD-2026-94633
GHSA-24c4-mg94-gv8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Splunk Enterprise over network
-
DeliverySend crafted unauthenticated request
-
ExploitBypass access control check
-
ExecutionRead restricted data
-
ImpactPartial confidentiality disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vendor advisory groups multiple issues under a single CWE and provides no specific precondition, feature flag, or configuration setting, so no concrete enabling condition can be extracted from the description. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-reachable, unauthenticated, and requires no user interaction against affected Splunk Enterprise versions below 9.4.15 / 10.0.10 / 10.2.7 / 10.4.3. The primary limiting factor is impact scope: only partial confidentiality (C:L) is at stake - no integrity or availability impact - and the affected instance must be network-reachable by the attacker; patched versions and network segmentation of the Splunk management/web interface fully mitigate. |
| Impact | This is a moderate-severity improper access control flaw (CWE-284) in Splunk Enterprise with a CVSS 3.1 base score of 5.3. The provided vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity access, but impact is limited to a partial confidentiality breach only (C:L/I:N/A:N), which caps real severity. Multiple risk signals align toward LOW real-world urgency: EPSS is only 0.15% (3rd percentile), the CVE is NOT in CISA KEV, and the SSVC decision framework reports Exploitation: none with Technical Impact: partial. The one elevating signal is SSVC Automatable: yes, meaning exploitation could be scripted at scale if a public exploit emerged - but no exploit currently exists. Note a tension worth verifying: the input Tag 'Authentication Bypass' implies a security-boundary failure, yet the vector shows no integrity or availability impact and only low confidentiality loss, so the practical consequence is likely limited information disclosure rather than full authentication bypass - treat the tag label cautiously. Overall this is a patch-in-normal-cycle item, not an emergency; prioritize based on Splunk's privileged position in security operations rather than on an imminent exploitation threat. |
| Exploit ScenarioDerived | A remote attacker without credentials sends a crafted request to an internet-reachable or network-adjacent Splunk Enterprise instance and exploits the improper access control to read data they should not be able to access. No public exploit code has been identified at the time of analysis, and the generic vendor advisory does not detail the exact request, so practical exploitation details are not yet established. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper access control in Splunk Enterprise (versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15) lets unauthenticated, network-positioned attackers reach functionality or data that should be restricted, exposing limited sensitive information with no integrity or availability impact (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw is tracked as CWE-284 and was fixed by Splunk as part of a set of internally identified issues grouped by weakness class, each receiving its own CVE; no public exploit code has been identified at time of analysis, EPSS is a low 0.15% (3rd percentile), and CISA's SSVC assessment rates exploitation as none with partial technical impact. Because exploitation requires only network reachability of the affected interface and no credentials or user interaction, the practical exposure is driven mainly by whether a Splunk web/management interface is exposed beyond a trusted network segment.
RemediationAI
Upgrade to a patched release on your supported branch: Splunk Enterprise 9.4.15, 10.0.10, 10.2.7, or 10.4.3 or later, following the vendor advisory https://advisory.splunk.com/advisories/SVD-2026-1002 (vendor-released patches; fixed versions confirmed in EUVD-2026-94633 as well). Where immediate upgrading is not possible, reduce exposure by restricting the Splunk web interface (8000/tcp) and management/REST interface (8089/tcp) to trusted administrative networks via firewall or reverse-proxy ACLs - the trade-off is that legitimate distributed search, heavy forwarders, and remote administrator access must be re-permitted by explicit allowlist or they will break. Avoid publishing Splunk management ports directly to the internet or to untrusted user VLANs, and review role definitions and capability assignments so that low-privilege or anonymous-capable roles cannot reach the affected functionality. Because exploitation requires only network reachability and no credentials or interaction, segmentation is the most effective interim control; monitoring Splunk audit logs for anomalous REST/web access from unexpected sources can help detect attempts, though it is detective rather than preventive. No public exploit code has been identified at time of analysis, so compensating controls are precautionary rather than responses to observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-284 (Improper Access Control) is the root-cause class: the software fails to enforce an authorization check on an operation or resource, so a caller can reach content or functionality that the intended permission model should have blocked. In Splunk Enterprise, authorization is normally governed by role-based access control over the search head, REST API, and management endpoints (commonly 8000/tcp for the web UI and 8089/tcp for the management/REST interface), so an access-control defect there can surface information to a caller who has not been granted the corresponding capability. The supplied CVSS 3.1 vector confirms the exposure is remote (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), but the impact is bounded to partial confidentiality (C:L) with no integrity (I:N) or availability (A:N) effect - consistent with unauthorized read access to limited data rather than full authentication bypass or remote code execution, even though the intelligence tags reference an authentication/authorization weakness. CPE cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* applies across all unpatched branches, and the vendor aggregates this CVE with others by CWE, so the specific internal component is not publicly enumerated.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Generic advisory plus CWE-284 supports network, low-complexity, unauthenticated access with only limited confidentiality disclosure and no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB