Splunk Enterprise EUVD-2026-63123

Phase one (payload staging) requires network reachability to the Splunk management port (default TCP 8089) and the ability to register a Deployment Server client identity - no authentication is required (PR:N per CVSS vector). The Deployment Server functionality must be active on the target instance. Phase two (detonation) requires an administrator to open the Add Data forwarder workflow after the crafted identity has been registered; exploitation cannot occur without this specific UI:R trigger. Limiting factors: management port is frequently firewalled from untrusted networks, reducing external attacker reachability; the detonation trigger depends on administrator workflow behavior and is not attacker-controlled in timing; and the attacker must know or guess that the payload will be triggered by this specific workflow rather than other administrative actions.

The CVSS 8.8 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately captures the split-phase nature of this attack: the initial payload registration requires no authentication and low complexity, while the detonation phase is gated by an administrator performing a specific UI action. The UI:R dependency is the primary risk moderator - exploitation is not fire-and-forget but requires the attacker to wait for an administrator to open the Add Data forwarder workflow, a realistic event in any environment actively onboarding forwarders. The management port (TCP 8089) is often restricted by perimeter controls in hardened deployments, but internal network reachability is common in large enterprise environments and SOC deployments where Splunk is most prevalent. No EPSS score is available in the provided data; no CISA KEV listing is present; and no POC has been identified at time of analysis. The absence of KEV reduces urgency slightly but should not create complacency - Splunk's management interface has historically attracted targeted exploitation, and the attack primitive (SPL injection via forwarder identity) is well within the capability of any attacker familiar with the platform. The Cisco attribution as reporter adds credibility to the severity assessment.

An attacker with internal network access to port 8089 registers a forwarder identity whose client name contains embedded SPL pipeline syntax, such as pipeline chaining operators or search commands that exfiltrate index data to an external destination. The malicious identity persists on the Deployment Server until an administrator navigates to the Add Data forwarder workflow during routine operations, at which point the unsanitized identifier is interpolated into a dispatched search and executes with the privileges of the Splunk search process. No public proof-of-concept has been identified at time of analysis, but the mechanism requires only knowledge of SPL syntax and Deployment Server registration protocol.