CVE-2026-76388

Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1

Description A user with the ess analyst role can modify User and Entity Behavior Analytics (UEBA) search macros. Because these macros are used by scheduled searches that execute with administrator permissions, this allows an analyst to gain unauthorized access to sensitive data and compromise system integrity. The issue stems from UEBA app metadata incorrectly granting write access to search macros to analyst roles instead of restricting it to administrator roles.

Recommendations Update to version 8.6.1 or later.