Splunk Enterprise EUVD-2026-107664

Exploitation requires the Edge Processor feature to be explicitly enabled on Splunk Enterprise (it is OFF by default), which exposes the affected Data Management REST API. The attacker must also already authenticate as a user holding a role with the preview_data_management_pipeline capability or the edit_data_management_pipeline_job capability. Given those prerequisites, the attacker simply references a Data Management SPL2 preview job ID belonging to another user, because the API enforces the capability but not ownership. Limiting factors: non-default feature activation, a valid authenticated account, and possession of one of the two specific capabilities; impact is confined to cross-user preview jobs and results (read/delete), not system-wide data.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4 MEDIUM) shows a network-reachable, low-complexity flaw that nonetheless requires an already-authenticated account (PR:L) holding a specific Splunk capability (preview_data_management_pipeline or edit_data_management_pipeline_job). This is a CWE-639 insecure-direct-object-reference/authorization bypass, not full authentication bypass, so the real-world attacker must already be a legitimate (if lower-privileged) Splunk user. Crucially, the affected Data Management REST API only exists when the Edge Processor feature is enabled, and that feature is OFF by default - a major mitigating factor that the raw CVSS score does not capture. No EPSS probability is provided in the input, there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or widespread exploitation. The only reference is the vendor advisory SVD-2026-1007, which was the basis for the Cisco-attributed report. Signals are internally consistent (authenticated, limited-impact, feature-gated); the dominant limiting factor is that most deployments will not have Edge Processor turned on, pushing effective real-world risk below what the MEDIUM score alone implies.

In a Splunk Enterprise environment (below 10.4.4) where an administrator has enabled the non-default Edge Processor feature, a low-privileged user who has been granted a role carrying the preview_data_management_pipeline or edit_data_management_pipeline_job capability calls the Data Management REST API and references a SPL2 preview job owned by another user. Because the API checks the capability but not ownership, the attacker reads that other user's preview data or deletes their preview jobs and results. No public exploit code is identified at time of analysis, so this would require a crafted API request by the authenticated insider.