CVE-2026-76352

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description Users without admin or power roles can create or modify scripted lookups via generic configuration endpoints. This occurs because these endpoints fail to enforce the necessary capabilities for creating or editing external lookup definitions. An attacker could execute an installed lookup script using the permissions of the account running the software, potentially granting access to all relevant data and compromising system integrity and availability.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.