CVE-2026-76259— Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
Affected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4< 10.4.2 | affected |
10.2< 10.2.6 | affected | ||
10.0< 10.0.9 | affected | ||
9.4< 9.4.13 | affected | ||
9.3< 9.3.14 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-76259
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
Source: CVE Program / CVE List V5
Vulnerability Description
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4 ~ 10.4.2 | - |
II. Public POCs for CVE-2026-76259
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76259
请登录查看更多情报信息。
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76350 | 8.8 HIGH | Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk En |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
| CVE-2026-76402 | 8.2 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Splunk Enterprise
- CVE-2026-76355
Unauthenticated Information Disclosure through an Edge Proce - CVE-2026-76354
Path Traversal through Search Head Clustering in Splunk Ente - CVE-2026-76353
Path Traversal through Knowledge Bundle Replication in Splun - CVE-2026-76352
Improper Authorization through the REST API in Splunk Enterp - CVE-2026-76351
Server-Side Request Forgery (SSRF) through the Report Notifi
Same vendor: Splunk
- CVE-2026-76405
Information Disclosure through Cleartext Storage in the App - CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector - CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru - CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST - CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S
Same weakness: CWE-269
- CVE-2026-53527
LeafWiki Vulnerable to Privilege Escalation via User Self-Se - CVE-2026-59799
Apache CloudStack: Missing Privilege Check in Two-Factor Aut - CVE-2026-17145
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-16997
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-16991
Vulnerabilities in IBM AIX and PowerVM VIOS
V. Comments for CVE-2026-76259
No comments yet