Splunk Enterprise CVE-2026-76309

Exploitation requires a valid Splunk Enterprise user account that does not hold the 'admin' or 'power' role - any standard low-privileged account is sufficient per the CVE description. The attacker must have network access to the Splunk REST API management port (default TCP 8089), which is accessible by default within enterprise network segments. No user interaction is required (UI:N confirmed by CVSS vector). Exploitation is constrained to the four affected version branches below their respective fix versions. The impact is read-only - CVSS C:L/I:N/A:N confirms data exfiltration is possible but data modification and denial-of-service are not indicated by available data. External unauthenticated users without a valid Splunk account cannot exploit this vulnerability, and accounts holding 'admin' or 'power' roles already have elevated access making SQL injection less meaningful as an escalation path.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 (Medium), reflecting a network-accessible, low-complexity attack requiring only a low-privileged account, with limited read-only confidentiality impact. The C:L/I:N/A:N breakdown strongly suggests a read-only SQL injection - the attacker can likely enumerate or extract database content but cannot modify or delete data, and no denial-of-service vector is indicated. No EPSS data was provided, limiting probabilistic exploitation assessment; however, the absence of a CISA KEV listing and the lack of any confirmed public POC indicate exploitation remains theoretical at time of analysis. Despite the moderate CVSS score, real-world risk may be higher in environments where Splunk indexes sensitive security telemetry, credentials, or operational data - SQL injection read access to such data can be high-value even without write capability. The requirement for a valid Splunk account (not admin or power role) is the primary limiting factor; this restricts the attacker pool to insiders or accounts obtained through prior compromise. No conflicting signals exist between the CVSS vector and the description.

An insider or attacker who has obtained a low-privileged Splunk Enterprise account (one without admin or power role) sends a crafted HTTP request to the Splunk REST API management port, embedding SQL metacharacters into a filter parameter. The unparameterized query construction causes Splunk's backend database to evaluate the injected SQL, allowing the attacker to enumerate tables or extract data rows beyond their authorized scope. No public proof-of-concept has been confirmed, but the attack pattern is a well-established SQL injection technique requiring no specialized tooling beyond standard HTTP clients.