Missing Authorization in Splunk Enterprise - CVE-2026-76294
Published: October 22, 2026
Vulnerability identifier: #VU156978
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76294
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to move field extractions or field transformations into apps they do not have permission to access.
The vulnerability exists due to missing destination app authorization in the Splunk Enterprise REST API when processing field extraction and field transformation move operations. A remote user can submit move requests targeting apps for which they lack read access to make unauthorized changes to the placement of these knowledge objects.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76294
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4