Splunk Enterprise EUVD-2026-63124

Exploitation requires a valid authenticated Splunk Enterprise user account on the target search head - specifically, any account that does not hold the 'admin' or 'power' Splunk role (i.e., a standard, restricted, or read-only user). No non-default configuration is required; the lookup configuration endpoint is present and active in all standard Splunk Enterprise installations across the affected version range. The attack is conducted over the network via the Splunk web interface (PR:L per CVSS vector confirms low-privilege authentication is the sole requirement). Limiting factors: (1) unauthenticated external attackers cannot exploit this - a Splunk account credential is a hard prerequisite; (2) accessible files are bounded by the OS-level read permissions of the account running Splunk Enterprise - files outside that account's permission scope are not reachable; (3) in distributed deployments the impact is confined to the search head and does not directly extend to indexers or forwarders.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat surface: the Splunk web interface is network-accessible, exploitation is low-complexity, and any valid Splunk account regardless of role suffices as a foothold. In typical enterprise Splunk deployments, user accounts are provisioned broadly for analysts and developers - meaning the effective attacker population is large. The unchanged scope (S:U) limits direct lateral movement to adjacent systems but full CIA impact on the search head itself is still severe, as search heads often hold sensitive indexed log data and configuration material. No EPSS score was available in the provided intelligence, so exploitation probability is inferred from the vulnerability class: path traversal against a staging area boundary check is historically straightforward to reproduce once the endpoint behavior is identified. The absence of a CISA KEV listing and no identified public exploit code moderates the immediate threat window, but Cisco's responsible disclosure and the broad version coverage across four release trains mean the vulnerability is well-characterized and patch deployment urgency is high. No conflicting signals were detected between the CVSS vector and the description.

An attacker holding a standard Splunk Enterprise user account (e.g., a read-only analyst account without admin or power role) submits a crafted API request to the lookup configuration endpoint, embedding path traversal sequences in the lookup source path parameter to reference a sensitive file outside the staging area - such as Splunk's internal configuration files or OS-level files readable by the Splunk service account. Because the endpoint does not normalize the path before evaluating staging area membership, the server moves the targeted file into the attacker's controlled lookup table. The attacker then issues a standard Splunk search query against that lookup to exfiltrate the file contents, and may additionally overwrite or delete files to degrade integrity and availability on the search head.