EUVD-2026-62953
GHSA-hj4g-r7xm-5vg9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Analyst role (PR:L) required over network (AV:N); macro modification causes no availability impact; high C and I reflect full data access and admin-privileged SPL execution.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.
AnalysisAI
Privilege escalation in Splunk Enterprise Security below 8.6.1 enables authenticated users holding the ess_analyst role to modify UEBA search macros that are subsequently executed by scheduled searches running under administrator permissions. The flaw stems from misconfigured UEBA app metadata that incorrectly grants analyst-tier write access to macros intended to be restricted to administrators, resulting in unauthorized access to all Splunk-indexed data and potential system integrity violations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Splunk Enterprise Security session with the ess_analyst role - either held legitimately by an insider or obtained through credential theft or account takeover. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 (High) score accurately reflects the damage potential: high confidentiality and integrity impact with only low privilege requirements and full network accessibility. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk Enterprise Security user with the ess_analyst role navigates to the UEBA app's macro configuration and modifies an existing search macro to include additional SPL commands - for example, appending a search that writes sensitive indexed data to an external lookup or a summary index the analyst controls. When the next scheduled search runs automatically with full administrator permissions, it executes the tampered macro and the injected commands run at admin privilege, granting the analyst access to all indexed data and the ability to alter search behavior SOC-wide. … |
| Remediation | Upgrade Splunk Enterprise Security to version 8.6.1 or later, which corrects the UEBA app metadata to restrict write access to search macros to administrator roles only; the vendor advisory is available at https://advisory.splunk.com/advisories/SVD-2026-0807. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise Security instances and their current versions, then restrict ess_analyst role assignments to trusted personnel while patching is prepared. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today