EUVD-2026-62919
GHSA-xmr2-67jq-5c93
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
REST API delivery justifies AV:N and AC:L; valid Splunk account required sets PR:L; file deletion/overwrite yields I:H and A:H with no confidentiality impact (C:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-search-head-clustering/about-search-head-clustering), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Secure Splunk Enterprise service accounts (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/install-splunk-enterprise-securely/secure-splunk-enterprise-service-accounts) in the Splunk documentation.
AnalysisAI
Search Head Clustering bundle replication in Splunk Enterprise fails to validate bundle filenames or neutralize NUL bytes before constructing file system paths on non-captain cluster members, allowing any authenticated low-privileged user to delete or temporarily overwrite files accessible to the Splunk service account via a crafted REST API request. Affected are Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 running in SHC deployments - standalone instances are not in scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Splunk Enterprise to be deployed in a Search Head Cluster (SHC) configuration; standalone deployments are not vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H accurately represent the threat profile: the attack is network-delivered, requires only a low-privileged Splunk account, and demands no user interaction or special access conditions beyond SHC being deployed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk user holding only a basic role - granted no admin or power privileges - sends a crafted REST API request to the SHC bundle replication endpoint of a non-captain cluster member, with a bundle filename containing an embedded NUL byte. The server constructs the destination path using the malformed filename, truncating it at the NUL byte to resolve outside the intended bundle directory, and proceeds to delete or overwrite a targeted file writable by the Splunk process account - such as a configuration file or index metadata - causing the affected SHC member to malfunction or fail. … |
| Remediation | Upgrade Splunk Enterprise to a fixed version: 10.4.2 or later for 10.4.x deployments, 10.2.6 or later for 10.2.x, 10.0.9 or later for 10.0.x, or 9.4.14 or later for 9.4.x, per vendor advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all Splunk Enterprise Search Head Clustering deployments and identify those running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14; simultaneously audit recent API access logs for suspicious bundle-replication activity from low-privilege accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today