CVE-2026-76313

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user without admin or power roles can achieve Remote Code Execution (RCE) by uploading a malicious knowledge bundle and triggering its use via distributed search. This occurs because the Representational State Transfer (REST) API endpoint for knowledge bundle upload does not enforce the edit dist peer capability, and distributed search accepts bundle selections from users lacking this privilege. Successful exploitation can lead to unauthorized data access and compromise system integrity and availability.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.