Splunk Enterprise CVE-2026-76294

Exploitation requires an authenticated Splunk Enterprise account that does NOT hold the 'admin' or 'power' roles, with access to the REST API endpoint that processes field extraction and field transformation move operations. The specific flaw is that this REST API path does not validate the user's read access to the destination app before relocating the knowledge object. Limiting factors: the attacker must already possess valid low-privilege credentials (PR:L, not unauthenticated), no user interaction from a victim is needed (UI:N), and impact is confined to integrity of knowledge-object placement (C:N, A:N) rather than data disclosure or service disruption. Only instances running versions below 10.4.4, 10.2.8, 10.0.11, or 9.4.16 are affected.

This is a low-to-moderate priority issue, not an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) yields a base score of 4.3 (Medium), driven entirely by a low integrity impact with no confidentiality or availability impact. PR:L confirms the attacker must already be an authenticated Splunk user - consistent with the description, which specifies a user lacking the 'admin' or 'power' roles. The signals are mutually consistent: no network-exposed unauthenticated path, limited blast radius (improper placement of field extractions/transformations into apps the user cannot read), and a CWE-862 Missing Authorization root cause. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or imminent exploitation. The only mild conflict worth noting is the input tag 'Authentication Bypass,' which overstates the issue - this is an authorization/access-control flaw (missing authorization), not an authentication bypass; the authenticated-user precondition still applies. Overall this is a genuine but contained insider/low-privilege misuse issue rather than a widely weaponizable critical bug.

A legitimate Splunk user who holds only basic (non-admin, non-power) roles uses the REST API to issue a 'move' operation on a field extraction or field transformation, targeting an app to which they have no read access. Because the REST API never validates destination app access, the knowledge object is relocated into that restricted app, letting a low-privilege user manipulate configuration state in apps they should not be able to touch. No public exploit code was identified at time of analysis, but exploitation requires only standard authenticated API access and low attack complexity.