EUVD-2026-62909
GHSA-x648-f8q4-x5jq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Network-accessible REST API exploitable with low-privileged credentials; scope changes as writes escape Splunk to host OS filesystem; no confidentiality or availability impact confirmed.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer (REST) API endpoint and affect system integrity on the host. The vulnerability is possible because Splunk Enterprise does not validate the search identifier before using it to create a dispatch directory. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
AnalysisAI
Path traversal in Splunk Enterprise allows low-privileged authenticated users to write dispatch metadata to arbitrary locations on the host filesystem by supplying a crafted search identifier to a REST API endpoint. Affected branches span versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, covering all currently maintained Splunk Enterprise release lines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Splunk Enterprise account that does NOT hold the 'admin' or 'power' Splunk role - a standard, low-privileged user account is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score is well-calibrated for this vulnerability: network-accessible (AV:N), low complexity (AC:L), requiring only low-privileged credentials (PR:L), no user interaction (UI:N), scope-changing (S:C), and carrying high integrity impact (I:H) with no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Splunk Enterprise account (any role below 'admin' or 'power') crafts a REST API request targeting the affected search endpoint, embedding a path traversal sequence such as '../../etc/cron.d/backdoor' as the search identifier. Splunk constructs a dispatch directory at the traversed path and writes metadata files there; if the traversed destination is writable by the OS user running Splunk, the attacker plants a file that executes under a privileged OS context. … |
| Remediation | Upgrade Splunk Enterprise to the patched versions released by Splunk: 10.4.2 for the 10.4 branch, 10.2.6 for the 10.2 branch, 10.0.9 for the 10.0 branch, or 9.4.14 for the 9.4 branch, as documented in vendor advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise deployments and identify instances running versions prior to 10.4.2, 10.2.6, 10.0.9, or 9.4.14. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-27 – Path Traversal: 'dir/../../filename'
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today