Splunk Enterprise CVE-2026-76339

The attacker must hold a valid Splunk account that does not have the 'admin' or 'power' role - standard low-privilege Splunk users are the threat actor profile. The victim must be an authenticated Splunk user with access to Splunk Web and must be actively phished or tricked into initiating the attacker-crafted geostats search within their browser session (UI:R confirmed by CVSS vector). The attack cannot be automated or performed without victim interaction (AC:H, UI:R in CVSS confirm this). Exploitation is limited to environments where low-trust and high-trust users share access to the same Splunk Enterprise instance. The injected commands are bounded by the victim's own Splunk permissions - if the victim is also a low-privilege user, the exposure is reduced accordingly. Splunk Cloud Platform instances are not listed as affected per available data.

The NVD-assigned CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N is broadly well-calibrated. The High Attack Complexity (AC:H) correctly reflects the mandatory social engineering step - the attacker must successfully phish an authenticated Splunk user into initiating a crafted search in Splunk Web, which is not a reliable, repeatable, or automated attack primitive. Low Privileges Required (PR:L) is accurate; the attacker must hold at minimum a non-admin, non-power Splunk account, ruling out entirely unauthenticated exploitation. The C:H rating is notable because 'all relevant data available to the second user, including stored credentials' is explicitly cited - in a SIEM context, this can mean access to forwarded security logs, credential stores, and API keys indexed within Splunk. The I:L rating reflects lookup file modification, which could be leveraged for data integrity attacks or further privilege escalation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The absence of KEV listing and publicly available exploit code further supports treating this as a medium-priority remediation rather than an emergency response item. Real-world risk is elevated specifically in multi-tenant or shared Splunk deployments where users of varying trust levels share a single Splunk Web instance.

An attacker with a low-privileged Splunk account constructs a geostats search query containing injected SPL commands designed to exfiltrate sensitive data - for example, by appending a command that reads and outputs stored credential lookup files. The attacker then sends a phishing link or crafted Splunk Web URL to a higher-privileged authenticated colleague, tricking them into executing the search in their browser session. The injected SPL runs under the victim's authorization context, silently exposing all data and lookup files accessible to that user back to the attacker.