SB2026082082 - Two vulnerabilities in Splunk Enterprise Security
Published: August 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-76387)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access sensitive data and modify system integrity available to scheduled searches.
The vulnerability exists due to improper input validation in Analyst Queue search filter handling through the REST API when processing user-supplied filter field names in SPL searches. A remote user can inject crafted SPL through Analyst Queue search filters to access sensitive data and modify system integrity available to scheduled searches.
Exploitation requires a role that contains the mc_investigation_read capability.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-76388)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access sensitive data and modify system integrity through scheduled searches running with administrator permissions.
The vulnerability exists due to incorrect permission assignment in UEBA search macros when scheduled searches use administrator permissions. A remote user can modify UEBA search macros to access sensitive data and modify system integrity through scheduled searches running with administrator permissions.
Exploitation requires the ess_analyst role.
Remediation
Install update from vendor's website.