EUVD-2026-62903
GHSA-2hhx-v97c-cm95
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector because the token endpoint is reached remotely; AC:H because exploitation requires prior possession of the distributed search private key; PR:N because the endpoint itself requires no Splunk credentials; full C/I/A:H because forged admin token grants complete access.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.
AnalysisAI
Authentication bypass in Splunk Enterprise across multiple supported version branches allows an attacker who has obtained a trusted distributed search private key to forge administrative session tokens entirely over the network. Affected versions span 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid trusted distributed search private key configured in the target Splunk Enterprise deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 base score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects the dual nature of this vulnerability: network-reachable and unauthenticated at the token endpoint itself, but gated by the high-complexity precondition of possessing the distributed search private key. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has previously compromised a Splunk search peer node (for example, via an unrelated OS-level vulnerability or stolen credential) extracts the distributed search private key from disk or memory on that peer. Using that key, the attacker crafts a forged authentication token and submits it to the search head's token endpoint, which accepts it without a signed-request validation. … |
| Remediation | Upgrade Splunk Enterprise to the patched versions: 9.4.14, 10.0.9, 10.2.6, or 10.4.2, per vendor advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Splunk Enterprise instances and determine which are running vulnerable versions (9.4.x <9.4.14, 10.0.x <10.0.9, 10.2.x <10.2.6, 10.4.x <10.4.2); audit access to and storage of distributed search private keys and review recent access logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today