Splunk Enterprise EUVD-2026-63113

Exploitation requires: (1) a valid Splunk user account that does NOT hold the 'admin' or 'power' role - any lower-privileged authenticated user qualifies; (2) the target Splunk instance must have been previously upgraded from an older Splunk Secure Gateway deployment; and (3) the Spacebridge private-key migration must have remained incomplete after that upgrade, leaving key material in the original KVStore collection with an insecure default ACL. Fresh (non-upgraded) deployments are not affected. Instances where the migration completed successfully are not affected. Exploitation is further limited to environments where the Splunk Secure Gateway app is installed and the KVStore REST API is reachable from the attacker's network position. The attack does not require any user interaction or elevated privileges beyond a basic authenticated Splunk session. What limits exploitation most is the conditional migration state, which is not present on clean installs or fully migrated upgrades.

The vendor-assigned CVSS 5.3 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the key risk trade-offs. The High confidentiality impact (C:H) is significant - private-key exposure is not a partial disclosure but full compromise of Spacebridge key material. However, AC:H correctly signals that exploitation is not universally applicable: it requires the specific post-upgrade condition of an incomplete key migration, which narrows the real-world exploitable population to a subset of upgraded installations. PR:L confirms that a valid Splunk account with any role below admin/power is sufficient, which is not a high bar in multi-user Splunk deployments. There is no CISA KEV entry and no identified public proof-of-concept, suggesting no current widespread exploitation. EPSS data was not provided, but given the conditional nature, opportunistic mass exploitation is unlikely. The primary real-world risk is insider threat or a compromised low-privilege Splunk account being used to extract Spacebridge key material for subsequent cryptographic attacks against mobile Splunk clients. The impact is scoped to confidentiality with no integrity or availability consequence.

An attacker with any valid low-privilege Splunk account - such as a read-only analyst account or a service account - queries the Splunk Secure Gateway KVStore REST API endpoint targeting the collection storing Spacebridge private keys on an instance that underwent an incomplete key migration. The API returns the private key material due to the permissive default ACL, enabling the attacker to impersonate the Spacebridge server or decrypt communications between Splunk mobile clients and the Spacebridge backend. No public proof-of-concept exploit has been identified at time of analysis.