Splunk Enterprise EUVD-2026-94584

Exploitation requires a valid authenticated Splunk Enterprise account with at least low-level privileges (CVSS PR:L) that can reach the Splunk network interface; the flaw is a Protection Mechanism Failure (CWE-693) that lets such an account bypass an intended security control to disclose information. Limiting factors: an attacker MUST already hold working credentials - this is not exploitable by a fully unauthenticated outsider - and the affected instance must be running a vulnerable version (Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, or 9.4.15). No user interaction is needed. The generic grouped-advisory description does not name a specific toggle or feature, so no non-default configuration is confirmed to be required; verify specifics against Splunk advisory SVD-2026-1002.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw with low attack complexity requiring low-level authenticated privileges (PR:L) and no user interaction - a plausible path for any user with a valid Splunk account to escalate access to data they should not see (C:H), with limited integrity and availability impact (I:L/A:L). CWE-693 (Protection Mechanism Failure) combined with the 'Information Disclosure' tag indicates a bypass of an intended security control leading to data exposure rather than direct code execution. Weighing the signals against each other: there is NO CISA KEV listing, NO EPSS score provided, and NO public exploit referenced - so despite the 7.6 'High' base score, there is no evidence of real-world exploitation. Notably, Splunk states these vulnerabilities were INTERNALLY identified and reported via Cisco (Splunk's parent), which typically correlates with lower immediate exposure since no external researcher or attacker disclosure is implied. Net assessment: patch on a normal maintenance cadence as an authenticated-user data-disclosure risk; this is not an emergency drop-everything issue absent any exploitation or POC signal. EPSS data is missing, so widespread-exploitation probability cannot be quantified from the provided inputs.

A low-privileged but authenticated Splunk Enterprise user (e.g., a limited-role analyst) sends crafted requests to the Splunk management/web interface that bypass an intended access-control or protection mechanism, causing the platform to return sensitive data the account was not authorized to view. No user interaction or administrative rights are required, but valid credentials are. No public exploit code was identified at time of analysis.