CVE-2026-76259 PUBLISHED

Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

Assigner: cisco
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor Splunk
Product Splunk Enterprise
Versions
  • affected from 10.4 to 10.4.2 (excl.)
  • affected from 10.2 to 10.2.6 (excl.)
  • affected from 10.0 to 10.0.9 (excl.)
  • affected from 9.4 to 9.4.13 (excl.)
  • affected from 9.3 to 9.3.14 (excl.)

Solutions

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

Credits

  • Aobo Wang (@M4x_1997) reporter
  • Gabriel Nitu, Splunk reporter

References

Problem Types

  • The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. cwe