Splunk Enterprise EUVD-2026-62903

Exploitation requires the attacker to possess a valid trusted distributed search private key configured in the target Splunk Enterprise deployment. This key is present only in environments where distributed search has been explicitly configured - standalone Splunk instances that do not use distributed search are not affected by this attack path. The attacker must be able to reach the distributed search authentication token endpoint over the network (AV:N), but no Splunk account credentials or session are required to submit the forged token request (PR:N). The limiting factors are: (1) distributed search must be enabled and configured with peer authentication; (2) the attacker must have separately obtained the private key, which requires a prior compromise of a peer node, access to backup/configuration files containing the key, or an insider threat; (3) AC:H reflects these preconditions - this is not a spray-and-pray attack but a targeted one following key exfiltration. No user interaction is required once the key is in hand.

The CVSS 8.1 base score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects the dual nature of this vulnerability: network-reachable and unauthenticated at the token endpoint itself, but gated by the high-complexity precondition of possessing the distributed search private key. The AC:H metric is the key differentiator - exploitation is not trivially opportunistic; it requires the attacker to have already obtained key material through a separate compromise vector such as a prior breach, insider access, or key management failure. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, indicating no confirmed widespread exploitation at time of analysis. Despite the precondition, organizations running distributed Splunk deployments at scale should treat this as urgent because the private key is a shared secret across multiple search peers - compromise of any one peer node exposes the key. The real-world risk is highest in large, distributed Splunk deployments where the key material is present on multiple hosts, increasing the attack surface for key exfiltration. Reporting by Cisco (a major network and security vendor) suggests the issue was discovered in a controlled research context rather than as active exploitation.

An attacker who has previously compromised a Splunk search peer node (for example, via an unrelated OS-level vulnerability or stolen credential) extracts the distributed search private key from disk or memory on that peer. Using that key, the attacker crafts a forged authentication token and submits it to the search head's token endpoint, which accepts it without a signed-request validation. The attacker then operates as an administrator, exfiltrating all indexed log data, modifying configurations, or disabling search services - no further authentication is required once the token is accepted. No public proof-of-concept code for this specific CVE has been identified at time of analysis.