Splunk Enterprise Security CVE-2026-76387

Exploitation requires a valid Splunk Enterprise Security account holding a role that includes the mc_investigation_read capability - this is not a default capability granted to all users and must be explicitly assigned. The attacker must have network access to the Splunk ES deployment and must be able to reach and interact with the Analyst Queue within Mission Control. The injected SPL executes only within the data access context of the scheduled searches tied to that user's permissions, not as unrestricted system-level code execution. Exploitation is limited to: (1) authenticated users only - unauthenticated access is not possible per the PR:L CVSS metric; (2) users specifically holding mc_investigation_read - general Splunk users without this capability cannot exploit this path; (3) the Analyst Queue feature in Mission Control must be accessible in the deployment.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N scores 8.1 High. The low-privileges metric (PR:L) is further scoped in practice: the attacker must hold a role specifically containing the mc_investigation_read capability, which is not universally assigned and represents a non-default, role-gated prerequisite. This meaningfully reduces the realistic attacker population to insiders, compromised analyst accounts, or privilege-escalation chains that land on an ES analyst role. The unchanged scope (S:U) limits blast radius to data and integrity within the scheduled search execution context, preventing direct host-level compromise. No KEV listing and no identified POC indicate this has not been exploited at scale as of analysis. The primary real-world risk profile is insider threat or lateral movement through a compromised analyst credential - not opportunistic mass exploitation. EPSS data was not provided in the input; exploitation probability is not independently assessable here.

An authenticated Splunk ES analyst whose role includes mc_investigation_read crafts a malicious Analyst Queue search filter in which the filter field name contains injected SPL tokens. When the Analyst Queue processes the filter, the unsanitized field name is concatenated into a scheduled SPL search string. The injected SPL executes in the context of that scheduled search, exposing data stores and integrity controls accessible to the scheduled search - including potentially sensitive security event data the analyst would not otherwise be authorized to view or modify.