Splunk Enterprise EUVD-2026-62907

The attacker must hold an authenticated Splunk 'power' role account on the target Splunk Enterprise instance - this role is typically granted to power analysts and is not a default low-privilege account. The Table Editor feature must be available and in use on the instance. The attack is not exploitable at will: successful exploitation additionally requires the attacker to socially engineer (phish) a user who holds the Splunk 'admin' role into opening the crafted shared dataset in the Table Editor, specifically triggering the Initial Data step. Exploitation is limited by the UI:R requirement - if the admin does not open the dataset, no commands execute. The CVSS PR:L vector confirms authentication as a power-role user is a hard prerequisite; unauthenticated or unprivileged attackers cannot exploit this vulnerability.

The vendor-assigned CVSS score of 5.4 (Medium) accurately captures the constrained exploitation path: AC:H reflects mandatory social engineering of an admin user, PR:L confirms the attacker must already hold an authenticated 'power' role account, and UI:R means exploitation cannot proceed without the victim taking a deliberate action. Despite the moderate composite score, the C:H rating is particularly meaningful in Splunk environments because admin sessions can access all indexed machine data, which frequently includes logs containing credentials, PII, and sensitive operational records. EPSS data was not present in the provided intelligence, preventing a probability-based comparison against the CVSS signal. The absence of a CISA KEV entry and the lack of any identified POC suggest this is not being exploited at scale, though the attack technique - abusing a trusted platform feature through social engineering - is well within the capability of insider threats or compromised power-role accounts. Organizations where many staff hold the 'power' role and where admins routinely open shared datasets face meaningfully higher exposure than tightly controlled deployments.

A threat actor who already holds a Splunk 'power' role account - whether through legitimate employment, credential theft, or insider access - crafts a Table Editor dataset containing risky SPL commands designed to output sensitive search results to an attacker-controlled lookup file, then shares the dataset through Splunk's collaboration features. The attacker sends a phishing message to a Splunk admin (e.g., a Slack message or email) claiming the dataset contains urgent security findings that need review. When the admin opens the dataset in Table Editor and triggers the Initial Data step, the embedded SPL executes silently under the admin's permissions, exfiltrating indexed data and writing results to a lookup file the attacker can later read.