Incorrect permission assignment for critical resource in Splunk Enterprise Security (ES) - CVE-2026-76388
Published: August 20, 2026
Vulnerability identifier: #VU144428
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76388
CWE-ID: CWE-732
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access sensitive data and modify system integrity through scheduled searches running with administrator permissions.
The vulnerability exists due to incorrect permission assignment in UEBA search macros when scheduled searches use administrator permissions. A remote user can modify UEBA search macros to access sensitive data and modify system integrity through scheduled searches running with administrator permissions.
Exploitation requires the ess_analyst role.
Affected software
Splunk Enterprise Security (ES)
How to mitigate CVE-2026-76388
Install security update from vendor's website.
Splunk Enterprise Security (ES) - update to 8.6.1