CVE-2026-76264

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15

Description Users without admin or power roles can create or edit scripted lookup definitions via raw configuration endpoints. This occurs because raw transforms configuration write paths fail to perform external lookup capability checks before saving scripted lookup settings.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.10 or later. Update Splunk Enterprise to version 9.4.15 or later.