Splunk Enterprise EUVD-2026-107661

Exploitation requires that the target run the Splunk Pipeline Builders app and expose the Edge Processor package download endpoint, which by default accepts package download requests without authentication (CVSS PR:N confirms unauthenticated access). The core limiting factor is deployment: instances not using Edge Processor / Pipeline Builders are not exposed. The vendor remediation - upgrading, re-preparing Edge Processor instances, and turning on authentication for Edge Processor package downloads - directly removes the unauthenticated-access precondition, so environments that have enabled that authentication setting are protected even against reachable attackers.

This is a CWE-400 uncontrolled resource consumption (denial-of-service) flaw in Splunk Enterprise. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges (PR:N confirms unauthenticated), no user interaction, and an availability-only impact (C:N/I:N but A:H). No EPSS score, KEV listing, POC, or SSVC decision data were supplied. Per precision rules this is 'no public exploit identified at time of analysis' - note that absence of these signals is not evidence of low risk, only of unknown exploitation activity. The real-world priority is moderate: it is trivially triggerable by an unauthenticated remote attacker but yields only resource exhaustion/unresponsiveness, not code execution or data disclosure, and it is further gated by whether the Edge Processor package download endpoint (Splunk Pipeline Builders app) is actually deployed and exposed. For environments running Edge Processor this is a credible availability threat worth patching promptly; for those not using that feature the practical exposure is much lower. No key signals here are conflicting, but the EPSS/KEV/POC fields are simply missing rather than contradicting the CVSS vector.

An unauthenticated attacker with network reachability to a Splunk Enterprise instance running the Splunk Pipeline Builders app repeatedly calls the Edge Processor package download endpoint. Because each request causes the Splunk daemon to read and base64-encode the entire package in memory, a flood of concurrent requests exhausts system resources and can make the daemon stop responding. No public exploit identified at time of analysis, and no special tooling is needed beyond an HTTP client capable of generating repeated requests.