Splunk On-Call CVE-2026-76405

Exploitation requires an active, authenticated Splunk session with at minimum a low-privileged Splunk role (PR:L per CVSS vector) - the vulnerability is specifically triggered by users who do NOT hold the 'admin' or 'power' Splunk roles, meaning standard users are the threat actors. The Splunk On-Call (VictorOps) app must be installed and configured on the Splunk instance, and the API key must have been stored in the KV Store (i.e., the integration must have been set up). The KV Store collection must be readable by non-elevated users, which is the default behavior that the app fails to restrict. Limiting factors: requires valid Splunk credentials (not anonymous/unauthenticated access), requires the On-Call app to be installed and active, and the exposed key is only partially masked - full key reconstruction is not confirmed possible from available data.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the attack profile: network-accessible, low complexity, requires an authenticated Splunk session with low privileges, no interaction needed, and impact limited to partial confidentiality loss. The confidentiality impact is rated Low because only a partially masked API key is exposed, not the full credential in cleartext. No EPSS score was provided in the intelligence data; given the absence of KEV listing and no public exploit code, real-world exploitation risk appears low and likely opportunistic rather than targeted. The primary realistic threat is an insider - a Splunk user with legitimate but limited access - discovering and attempting to leverage the partial key. Whether the partial key is sufficient to reconstruct or directly use the full API key is not addressed in the advisory, which is a meaningful unknown: if the masking scheme leaves enough entropy visible, risk increases meaningfully. No conflicting signals between CVSS vector and description - both indicate authenticated, network-based access.

An authenticated Splunk user with no elevated role queries the Splunk On-Call app's KV Store collection via Splunk's REST API or Search Processing Language (SPL), retrieves the stored API key record, and reads the partially masked value. Depending on the masking scheme, the attacker may attempt to infer or brute-force the full key and subsequently make unauthorized API calls to the VictorOps/Splunk On-Call service to enumerate on-call schedules, escalation policies, or trigger/resolve incidents. No public exploit code has been identified at time of analysis.