Splunk Enterprise CVE-2026-76353

The attacker must possess a valid Splunk Enterprise account; however, the 'admin' and 'power' roles are explicitly NOT required - any lower-privileged role (e.g., user, read-only) is sufficient. The target environment must be a clustered Splunk Enterprise deployment using a cluster manager (formerly master node), as the vulnerability exists in the knowledge bundle delta processing endpoint specific to that architecture. Single-instance or non-clustered Splunk deployments do not expose a cluster manager and may not be affected in the same way. The attacker must have network-level access to the cluster manager's management interface. Non-default configurations are not required - the knowledge bundle replication feature is enabled by default in clustered deployments. Limiting factors include: authentication is required (PR:L), meaning unauthenticated external attackers cannot exploit this directly; the target must be a clustered deployment; and impact is limited to file deletion (no confidentiality breach, no code execution confirmed from available data).

The NVD CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the attack surface: network-reachable, low complexity, requiring only a standard Splunk account. The dual I:L and A:L impacts are appropriate - file deletion degrades both integrity and availability without direct data exfiltration, keeping C:N. The most significant real-world risk factors are the low authentication bar (any Splunk user, a common population in enterprise deployments) and the fact that Splunk Enterprise is widely used as a security operations platform, meaning file deletion targeting Splunk's own configuration or index data could impair SIEM visibility - a particularly sensitive outcome for security teams. No EPSS score was provided in the input; this cannot be independently confirmed. No KEV listing is present, and no POC has been identified, suggesting exploitation remains theoretical or targeted rather than widespread at time of analysis. The absence of a confidentiality impact limits the worst-case scenario relative to a full RCE, but the ability to delete arbitrary files as the Splunk service account on a cluster manager represents a meaningful integrity and availability threat in production environments.

An attacker with any valid Splunk Enterprise account - such as a read-only analyst account or a service account with minimal permissions - constructs a knowledge bundle delta payload containing path traversal sequences (e.g., '../../') in the file removal list. They submit this delta to the cluster manager's bundle replication endpoint over the network without needing admin or power role privileges. The cluster manager processes the malicious delta, follows the traversal paths outside the staging directory, and deletes targeted files accessible to the Splunk service account - potentially including Splunk configuration files, index data, or OS-level files - causing service disruption or integrity compromise.