Splunk Enterprise EUVD-2026-63126

Exploitation requires a valid Splunk account with at minimum the ability to initiate searches - no administrative rights or the fsh_manage capability are needed. The Federated Search feature must be accessible to the attacker's account; if Federated Search is completely disabled or the account's role explicitly excludes search dispatch, the attack surface is reduced. The CVSS PR:L confirms that a low-privileged authenticated user is sufficient. The limiting factor is the requirement for a valid Splunk account: unauthenticated external attackers cannot exploit this without first obtaining credentials. Additionally, deployments that have revoked or never granted Federated Search dispatch access to low-privileged roles are not exposed via that attack path. There is no requirement for a non-default configuration to be vulnerable - any standard Splunk Enterprise installation with user accounts and Federated Search available is affected.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects genuine high risk: the attack is network-reachable, requires no special configuration or complex conditions, and only demands a low-privileged Splunk account - not an administrative credential. Full CIA impact is appropriate given RCE grants control over the Splunk server, which in enterprise deployments typically ingests and stores sensitive log data across the entire organization. This is not a case of CVSS inflation: the access prerequisite (valid account) is a real barrier, but in many organizations Splunk access is granted broadly to analysts and operators. The absence of a CISA KEV listing and no confirmed POC lowers immediate urgency slightly, but the low exploitation complexity and high business impact of Splunk compromise - a platform trusted with security telemetry - make this a genuine remediation priority. EPSS data was not provided; exploitation probability should be considered elevated given the broad Splunk user base and relative ease of triggering the missing capability check.

An attacker with a standard low-privileged Splunk analyst account - the kind routinely provisioned in SOC environments - submits a specially crafted Federated Search request containing a malicious bundle identifier. Because the dispatch flow does not check for fsh_manage, the server processes the attacker-supplied bundle and executes arbitrary code in the context of the Splunk server process. No administrative credentials, no special network position, and no victim interaction are required beyond having a valid login.