Splunk Enterprise EUVD-2026-63120

Exploitation requires a valid Splunk Enterprise user account that does not hold the admin or power role - any standard or lower-privilege role is sufficient. The target Splunk deployment must be configured with distributed search (search heads connected to one or more search peers), as the attack leverages the knowledge bundle replication mechanism specific to that architecture. The Splunk REST API endpoint (default port 8089) must be reachable by the attacker. Unauthenticated exploitation is not possible per the PR:L CVSS vector. Single-instance Splunk deployments without distributed search are not exposed to this specific execution path. Non-default configurations that explicitly restrict the knowledge bundle REST endpoint to admin/power users via network controls would limit exposure but are not the default posture.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile: network-accessible, low complexity, requiring only a valid (non-privileged) account, with no user interaction needed and full impact across confidentiality, integrity, and availability. The PR:L vector is significant - exploitation is not limited to misconfigured environments but is available to any authenticated user including service accounts, trial accounts, or compromised analyst credentials. The attack is automatable (AC:L, UI:N) against any Splunk deployment using distributed search. No EPSS data was available in the provided intelligence sources. No CISA KEV listing and no public POC have been identified, meaning active exploitation is not confirmed, but the low complexity and broad authentication surface elevate urgency. The exploitation path leverages a legitimate Splunk feature (knowledge bundle replication), which may reduce detectability via standard alerting. Single-instance deployments without distributed search are not exposed to this specific execution vector.

An attacker with a low-privilege Splunk account (e.g., a compromised analyst credential or a service account without admin/power roles) crafts a malicious knowledge bundle containing a payload designed to execute arbitrary commands on search peers. The attacker submits the bundle to the unguarded REST API upload endpoint and then invokes a distributed search query, specifying the malicious bundle as the knowledge source. Splunk's distributed search subsystem - which does not re-validate the caller's capability - distributes and executes the bundle across search peers, granting the attacker RCE and access to all indexed data. No public exploit code has been identified, but the REST API surface is well-documented, lowering the barrier to independent exploit development.