CVE-2026-76266

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15

Description On Linux, a local user with the ability to execute commands as the account running Splunk Enterprise can achieve root privileges during a package upgrade. This occurs because the Linux package maintainer script trusts existing installation content when performing upgrade operations with root privileges. Exploitation requires the local user to modify the installation before a package upgrade is initiated.

Recommendations Update Splunk Enterprise to version 10.4.3 or later. Update Splunk Enterprise to version 10.2.7 or later. Update Splunk Enterprise to version 10.0.10 or later. Update Splunk Enterprise to version 9.4.15 or later.