CVE-2026-76255

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

• CWE-862

• https://advisory.splunk.com/advisories/SVD-2026-0801Mitigation, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Aug 27, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76244stigmem-node contains an insecure default configuration vuln…9.1
• CVE-2026-76245stigmem (pip package stigmem-node) version 0.9.0a1 contains …7.1
• CVE-2026-76251In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0…7.1
• CVE-2026-76252In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.1
• CVE-2026-76253In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …8.8
• CVE-2026-76254In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …8.8
• CVE-2026-76256In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …4.3
• CVE-2026-76257In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76258In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76259In Splunk Enterprise for Windows versions below 10.4.2, 10.2…7.8
• CVE-2026-7626The Slek Gateway for WooCommerce plugin for WordPress is vul…5.3
• CVE-2026-76260In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5