EUVD-2026-63111
GHSA-fp6q-c27c-462m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local Windows account
-
DeliveryPre-bind Splunk management port TCP 8089
-
ExploitAwait Splunk service start or restart
-
ExecutionReceive auth tokens from Splunk child processes
-
PersistReplay captured tokens against Splunk API
-
ImpactExfiltrate indexed data and compromise Splunk integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have a local interactive or remote desktop session on the Windows host running Splunk Enterprise (AV:L confirmed by CVSS). A low-privileged Windows account is sufficient (CVSS PR:L); no Splunk credentials or administrative rights are required. The attack window is contingent on a Splunk service startup or restart cycle - the attacker must pre-bind TCP port 8089 before the Splunk service listener claims it. The vulnerability is limited to the Windows platform; Linux and macOS Splunk deployments are not affected per the description. Exploitation is further limited by the need to have a persistent process running on the host at the moment of service startup, which may require persistence or coordination with a service restart event. |
| Impact | The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the attack surface: local access is required, complexity is low once on the host, and only low-privileged credentials are needed. The full C/H/I/H/A:H impact triad is consistent with token interception yielding complete Splunk session compromise. EPSS of 0.12% at the 3rd percentile is notably low relative to the CVSS score, suggesting real-world exploitation has not materialized at scale. The vulnerability is not listed in CISA KEV, and no POC has been identified. The practical risk is elevated in environments where Splunk Windows hosts are shared with other users or where insider threat is a concern, and is reduced where Splunk runs on dedicated, access-controlled Windows servers. There is no apparent conflict between the CVSS vector and the description; both consistently indicate a local, authenticated attack path. |
| Exploit ScenarioDerived | An attacker with a low-privileged local Windows account on the Splunk host runs a listener bound to TCP port 8089 (the Splunk management port) and waits for a Splunk service restart or system reboot. When Splunk initializes, its child processes send authentication tokens to the pre-bound attacker listener instead of the legitimate management service; the attacker captures these tokens and replays them against the Splunk REST API to access indexed data, configuration, and capabilities under the Splunk service account. No public POC has been identified, but the technique requires only standard Windows socket APIs available to any local user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 20, 2026
Splunk Enterprise for Windows exposes a startup race condition on the management port that allows a low-privileged local user to intercept authentication tokens from Splunk child processes. By pre-binding the management port before the Splunk service initializes - exploiting the absence of exclusive address binding protections on Windows - an attacker captures session tokens that can be replayed to compromise all data and system integrity accessible to the Splunk service account. No public exploit code has been identified and EPSS is 0.12% (3rd percentile), indicating low current exploitation activity; however, the vulnerability is Windows-specific and patch is available from Splunk.
Earlier versions of this analysis (1)
Privilege escalation in Splunk Enterprise for Windows allows a local low-privileged user to hijack the management-port listener before the Splunk service starts, intercept authentication tokens exchanged with child processes, and replay those tokens to fully compromise confidentiality, integrity, and availability of all data and functions accessible to the Splunk service account. Affected branches span versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, exclusively on Windows - Linux and macOS deployments are not affected. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV, but the CVSS 8.8 score with scope change accurately reflects the potential blast radius given Splunk's broad data access in enterprise environments.
RemediationAI
Upgrade Splunk Enterprise for Windows to the fixed versions: 9.3.14, 9.4.13, 10.0.9, 10.2.6, or 10.4.2, per the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. Where immediate patching is not feasible, restrict local logon rights on the Windows host running Splunk Enterprise to the minimum necessary accounts using Windows Local Security Policy or Group Policy (User Rights Assignment: Deny log on locally), reducing the pool of accounts that can pre-bind the management port. Additionally, configure Windows Firewall to block localhost-originating connections to the Splunk management port (TCP 8089) from processes other than the Splunk service account, though this control may be complex to maintain and should be treated as a temporary measure only. Restarting Splunk more frequently in untrusted multi-user environments increases exposure; minimize unplanned restarts until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-269 (Improper Privilege Management) arising from a Windows-specific socket binding behavior. On Windows, without the SO_EXCLUSIVEADDRUSE socket option, multiple processes can bind to the same TCP port. Splunk Enterprise's management-port listener (default TCP 8089) does not apply exclusive address binding before the service fully initializes, creating a startup window during which any local process can pre-occupy that port. When Splunk child processes subsequently attempt to authenticate through the management port, they connect to the attacker's listener rather than the legitimate Splunk service, transmitting authentication tokens directly to the adversary. The CPE cpe:2.3:a:splunk:splunk_enterprise applies exclusively to the Windows platform deployment based on the vulnerability description; Linux and macOS deployments are not indicated as affected.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low-privileged account required; token interception yields full confidentiality, integrity, and availability impact within Splunk's scope.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.
Executive ViewAI
Splunk Enterprise on Windows contains a startup race condition allowing low-privileged local users to intercept authentication tokens and compromise all Splunk-managed data and system integrity. No public exploit identified at time of analysis and current exploitation activity is minimal (0.1% EPSS), but organizations should patch promptly to prevent potential token-based lateral movement and unauthorized access to sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB