Splunk Enterprise EUVD-2026-62919

Exploitation requires Splunk Enterprise to be deployed in a Search Head Cluster (SHC) configuration; standalone deployments are not vulnerable. The attacker must possess any valid Splunk account that does not hold the 'admin' or 'power' role - basic authenticated users qualify, meaning the credential barrier is low in organizations with broad Splunk user populations. The targeted node must be a non-captain SHC member; the SHC captain is not the attack target. The REST API must be network-reachable from the attacker (AV:N per the CVSS vector, PR:L confirming authentication is required). No non-default feature flags or special platform conditions beyond SHC membership are required. Factors limiting exploitation include: the mandatory SHC deployment mode, the requirement for at least one valid Splunk credential (PR:L - unauthenticated exploitation is not possible), the restriction to non-captain members only, and the constraint that only files writable by the Splunk service account can be targeted.

The CVSS 8.1 score and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H accurately represent the threat profile: the attack is network-delivered, requires only a low-privileged Splunk account, and demands no user interaction or special access conditions beyond SHC being deployed. The absence of confidentiality impact (C:N) limits the blast radius compared to a full credential-theft scenario, but the combination of high integrity and availability impact is particularly damaging in environments where Splunk serves as the primary SIEM - disrupting or corrupting a non-captain search head directly impairs threat detection capacity. No EPSS data was supplied, and the CVE does not appear in CISA KEV, which moderates urgency relative to the raw score; the lack of public POC also reduces the immediate automated-exploitation risk. That said, any organization running SHC - whether a large enterprise or a mid-sized security operation - should treat patching as a near-term priority, because the low privilege requirement means any internal Splunk user without admin or power roles is a potential threat actor. SSVC signals support a 'Track Closely / Act' posture: exploitation is not yet confirmed automated, but the technical impact is total for availability on affected nodes. The SHC deployment prerequisite is the primary limiting factor; defenders should confirm whether their Splunk estate runs clustered or standalone before triaging urgency.

An authenticated Splunk user holding only a basic role - granted no admin or power privileges - sends a crafted REST API request to the SHC bundle replication endpoint of a non-captain cluster member, with a bundle filename containing an embedded NUL byte. The server constructs the destination path using the malformed filename, truncating it at the NUL byte to resolve outside the intended bundle directory, and proceeds to delete or overwrite a targeted file writable by the Splunk process account - such as a configuration file or index metadata - causing the affected SHC member to malfunction or fail. No public proof-of-concept code has been identified at time of analysis.