Splunk Enterprise EUVD-2026-62908

Any valid Splunk user account is sufficient - the 'admin' or 'power' role is explicitly NOT required, meaning standard analyst, read-only, or developer accounts are all viable. The Data Orchestration feature must be in use on the target Splunk Enterprise instance (it is not enabled by default in all deployments - organizations not using Data Orchestration jobs may have reduced exposure). The vulnerable endpoint must be reachable over the network (CVSS AV:N), which in enterprise deployments typically means the Splunk web interface is accessible. What limits exploitation: requires a valid Splunk authentication credential (PR:L - unauthenticated external exploitation is not possible); scoped to Splunk Enterprise only (not confirmed for other Splunk products); restricted to affected version branches.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects network-accessible exploitation requiring only low-privilege Splunk authentication, with high confidentiality impact and no integrity or availability impact. The 6.5 base score understates operational risk in several ways: first, low-privilege Splunk accounts are broadly distributed in enterprise deployments (analysts, developers, read-only consumers), making the attacker population large; second, the exposed data includes stored connection credentials, which can serve as a pivot to downstream systems not directly affected by this CVE. No EPSS score was provided in the intelligence data. No CISA KEV listing is present, and no public exploit code has been identified at time of analysis - however, CWE-89 is a well-understood class with trivially constructable payloads once the injection point is located. The absence of a POC does not provide significant protection given the simplicity of the exploitation class. Priority should be elevated relative to CVSS score alone due to the credential theft impact pathway.

An attacker with any valid low-privilege Splunk user account sends a crafted HTTP request to the Data Orchestration jobs endpoint, embedding SQL injection payloads within job filter parameters (for example, a UNION-based injection to retrieve all rows from the jobs table). The application concatenates the unsanitized input into a live SQL query, returning job records belonging to other users and stored database connection credentials. No public exploit code has been identified at time of analysis, but CWE-89 exploitation is well-documented and the technique is straightforward to implement once the vulnerable parameter is identified.