CVE-2026-76259
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 22:17:13.927000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-76259",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T22:17:13.927",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts."
},
{
"lang": "es",
"value": "En Splunk Enterprise para Windows versiones anteriores a 10.4.2, 10.2.6, 10.0.9, 9.4.13 y 9.3.14, un usuario local con acceso al host de Windows podría vincularse al puerto de gestión antes de que Splunk Enterprise se inicie, interceptar tokens de autenticación de procesos secundarios y usar esos tokens para comprometer todos los datos relevantes y la integridad del sistema disponibles para la cuenta de usuario que ejecuta Splunk Enterprise. La vulnerabilidad es posible porque el oyente del puerto de gestión de Windows no aplica protecciones de vinculación de dirección exclusiva antes de que el servicio se inicie."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.4",
"lessThan": "10.4.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2",
"lessThan": "10.2.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.14",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-21T03:57:04.458467Z",
"id": "CVE-2026-76259",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.14",
"matchCriteriaId": "5F8DAAEB-0D7B-44A4-9373-CFAC28B6C7BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.13",
"matchCriteriaId": "8BEBD0A0-2CFD-4DDE-BF01-E64A9D7FD14C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.9",
"matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.6",
"matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.4.0",
"versionEndExcluding": "10.4.2",
"matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}