CVE-2026-76266
HIGH 7.7In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.
Severe if exploited (CVSS 7.7), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 4th percentile
Impact if exploited
7.7CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires an admin / high-privilege account
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-269: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Splunk | Splunk | ≥ 9.4.0 and < 9.4.15 |
| Splunk | Splunk | ≥ 10.0.0 and < 10.0.10 |
| Splunk | Splunk | ≥ 10.2.0 and < 10.2.7 |
| Splunk | Splunk | ≥ 10.4.0 and < 10.4.3 |
All CVSS metrics
- HIGH 7.7 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - HIGH 7.7 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
Patches & mitigations
- https://advisory.splunk.com/advisories/SVD-2026-1001 CVE record · cisco · Updated 2026-10-07T20:46:29.794Z
NVD · CVE-2026-76266 · Updated 2026-10-14T12:22:06.520
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94618 EUVD · EUVD-2026-94618