Monthly
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Splunk AI Toolkit before version 6.0.1 allows authenticated users holding the built-in 'power' role to modify app-provided scheduled searches, which execute SPL under the permissions of the search owner rather than the modifying user. By injecting arbitrary SPL into such searches, a 'power' role user can access all data visible to the search owner and alter system integrity - effectively escalating privileges beyond their authorization level. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Splunk Enterprise Security below 8.6.1 enables authenticated users holding the ess_analyst role to modify UEBA search macros that are subsequently executed by scheduled searches running under administrator permissions. The flaw stems from misconfigured UEBA app metadata that incorrectly grants analyst-tier write access to macros intended to be restricted to administrators, resulting in unauthorized access to all Splunk-indexed data and potential system integrity violations. No public exploit or CISA KEV listing exists at time of analysis, though the low barrier - any ess_analyst account - makes insider threat and compromised analyst credential scenarios credible attack paths.
The Nmap Scanner connector for Splunk SOAR (versions prior to 3.0.15) permits privileged users to bypass Safe Mode playbook restrictions by exploiting a manifest miscategorization that marks the scan network action as read-only despite its accepting NSE script parameters capable of write operations and command execution on target systems. Users holding roles that allow editing, creating, or running playbooks can leverage this gap to run arbitrary Nmap Scripting Engine scripts against networked targets through SOAR automation - a meaningful privilege escalation given SOAR platforms typically have broad network reach. No public exploit has been identified at time of analysis, and a vendor patch is available via Splunk advisory SVD-2026-0806.
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.
Insufficient access controls on the Splunk Secure Gateway App Key Value Store REST API expose Spacebridge asymmetric private keys to any authenticated low-privilege user lacking the 'admin' or 'power' role. The exposure is conditional on instances that were upgraded from older Splunk Secure Gateway deployments where a private-key migration remained incomplete, leaving sensitive cryptographic material in a KVStore collection governed by an insecure default ACL. No public exploit code exists at time of analysis, but successful exploitation fully compromises the affected Spacebridge private-key material, enabling cryptographic impersonation or decryption of Spacebridge-protected communications.
Splunk Enterprise incorrectly gates the properties REST endpoint on the rest_properties_get capability rather than the purpose-built list_storage_passwords capability, allowing any authenticated user with that role permission to read encrypted stored credentials via the REST API. Affected branches span four active release lines: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14 per EUVD-2026-63112. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the flaw is mechanically straightforward for any user whose role carries the misassigned capability.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Splunk AI Toolkit before version 6.0.1 allows authenticated users holding the built-in 'power' role to modify app-provided scheduled searches, which execute SPL under the permissions of the search owner rather than the modifying user. By injecting arbitrary SPL into such searches, a 'power' role user can access all data visible to the search owner and alter system integrity - effectively escalating privileges beyond their authorization level. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Splunk Enterprise Security below 8.6.1 enables authenticated users holding the ess_analyst role to modify UEBA search macros that are subsequently executed by scheduled searches running under administrator permissions. The flaw stems from misconfigured UEBA app metadata that incorrectly grants analyst-tier write access to macros intended to be restricted to administrators, resulting in unauthorized access to all Splunk-indexed data and potential system integrity violations. No public exploit or CISA KEV listing exists at time of analysis, though the low barrier - any ess_analyst account - makes insider threat and compromised analyst credential scenarios credible attack paths.
The Nmap Scanner connector for Splunk SOAR (versions prior to 3.0.15) permits privileged users to bypass Safe Mode playbook restrictions by exploiting a manifest miscategorization that marks the scan network action as read-only despite its accepting NSE script parameters capable of write operations and command execution on target systems. Users holding roles that allow editing, creating, or running playbooks can leverage this gap to run arbitrary Nmap Scripting Engine scripts against networked targets through SOAR automation - a meaningful privilege escalation given SOAR platforms typically have broad network reach. No public exploit has been identified at time of analysis, and a vendor patch is available via Splunk advisory SVD-2026-0806.
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.
Insufficient access controls on the Splunk Secure Gateway App Key Value Store REST API expose Spacebridge asymmetric private keys to any authenticated low-privilege user lacking the 'admin' or 'power' role. The exposure is conditional on instances that were upgraded from older Splunk Secure Gateway deployments where a private-key migration remained incomplete, leaving sensitive cryptographic material in a KVStore collection governed by an insecure default ACL. No public exploit code exists at time of analysis, but successful exploitation fully compromises the affected Spacebridge private-key material, enabling cryptographic impersonation or decryption of Spacebridge-protected communications.
Splunk Enterprise incorrectly gates the properties REST endpoint on the rest_properties_get capability rather than the purpose-built list_storage_passwords capability, allowing any authenticated user with that role permission to read encrypted stored credentials via the REST API. Affected branches span four active release lines: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14 per EUVD-2026-63112. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the flaw is mechanically straightforward for any user whose role carries the misassigned capability.