Splunk Enterprise EUVD-2026-62906

Exploitation requires the attacker to hold the Splunk 'power' role on the target Splunk Enterprise instance - this role is the specific prerequisite granting the ability to create Table Editor datasets and share them with other users. The victim must hold the Splunk 'admin' role, as the attack's value is executing SPL under elevated admin permissions. The Table Editor feature must be accessible, and the attacker must successfully phish the administrator into opening the malicious dataset specifically within the Table Editor interface; the SPL payload is triggered during Table Editor's initial data preparation phase. The key limiting condition is that the attacker cannot self-trigger the payload - admin interaction is a hard requirement, meaning the attacker has no independent control over when or whether exploitation occurs. Scope is confined to the search head; the vulnerability does not directly affect indexers or other Splunk components. Non-default conditions: none are required beyond the attacker holding a 'power' role, which is a standard enterprise Splunk role assignment, not an obscure configuration.

The vendor CVSS score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N correctly reflects compounding constraints that substantially reduce real-world exploitability. High Attack Complexity (AC:H) and required User Interaction (UI:R) impose a social engineering prerequisite - the attacker must successfully phish a Splunk administrator after constructing the malicious dataset. Low Privileges (PR:L) means the attacker must already hold the Splunk 'power' role, confining the attack surface to insider threats or accounts that are already partially compromised. No EPSS data was provided, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA's KEV catalog, and no public proof-of-concept was identified at time of analysis, reinforcing its lower-immediacy profile. Despite the High confidentiality impact (C:H) - reflecting potential exposure of all data accessible to the search head admin - the compounding prerequisites of power role possession plus successful phishing plus admin interaction make mass or opportunistic exploitation unlikely. This vulnerability is most relevant as an insider threat vector or a post-initial-access privilege escalation path, not a perimeter-facing risk.

A malicious insider holding the Splunk 'power' role crafts a Table Editor dataset embedding SPL commands that search for and export sensitive index data - such as credentials stored in logs, security event records, or user activity data - accessible to admin-level accounts. The attacker shares the dataset with a Splunk administrator and delivers a phishing message via email or internal chat claiming the dataset contains an urgent report requiring review. When the administrator opens the dataset in the Table Editor, the malicious SPL executes silently under admin permissions, exfiltrating data or altering search configurations on the search head without any visible indication to the victim. No public proof-of-concept exists at time of analysis.