Splunk Enterprise CVE-2026-76352

The vulnerability requires a valid authenticated Splunk account for a user who does not hold the 'admin' or 'power' Splunk roles - users with those elevated roles already have legitimate scripted lookup creation rights, so this is an authorization bypass specific to lower-privileged accounts. The attacker must reach the Splunk REST API or web interface over the network (consistent with AV:N in the CVSS vector). A meaningful secondary constraint is that the malicious script file must be accessible to the Splunk service process on the host filesystem or a network path - Splunk does not provide a native file-upload mechanism in this flow, so the attacker must have previously placed or identified a writable script location. Exploitation is further limited by: (1) the requirement for at least a valid low-privileged Splunk credential; (2) the need for an executable script reachable by the Splunk service account; and (3) the script executing only under Splunk's OS service account permissions, which may or may not be root depending on the deployment. No user interaction from a victim is required, no special timing applies, and no non-default Splunk configuration is needed - the generic transforms endpoints are present in all standard installations.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the real-world severity of this privilege escalation. Attack complexity is genuinely low - no race condition, no brute force, and no unusual environment is required - only a valid authenticated session. The PR:L designation confirms that any non-admin Splunk account suffices, and in large enterprise deployments Splunk user populations routinely number in the hundreds, dramatically widening the potential attacker pool. EPSS data was not included in available intelligence, but the accessible network attack surface and negligible complexity suggest a non-trivial exploitation probability. No CISA KEV listing was identified and no confirmed public exploit exists at time of analysis, which moderates urgency relative to confirmed-exploited issues, but does not substantially reduce real-world risk given how easily the path can be reconstructed from the advisory alone. Even a mid-sized municipal IT team in sopot running Splunk for log aggregation and security monitoring should treat this as urgent, since Splunk commonly operates with elevated OS-level service account privileges and indexes sensitive security data across the enterprise. The systemic CWE-285 flaw affects all generic transforms endpoints regardless of user role, meaning no partial configuration-level mitigation exists short of patching or blocking API access.

An attacker holding any valid low-privileged Splunk account - such as a contractor account, a compromised analyst credential, or an application service account - authenticates to the Splunk REST API and submits a crafted POST request to a generic transforms configuration endpoint to register a scripted lookup pointing to a malicious script file accessible on the host. When any Splunk search triggers that lookup, Splunk executes the script under the OS-level service account, granting the attacker full read access to all indexed data and the ability to affect system integrity and availability. No public POC has been confirmed, but the attack requires only standard Splunk API knowledge derivable from public documentation.