CVE-2026-76259
Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.
| CWE | CWE-269 |
| Vendor | splunk |
| Product | splunk enterprise |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for splunk splunk enterprise
Be the first to know when new high vulnerabilities affecting splunk splunk enterprise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Splunk / Splunk Enterprise
10.4 < 10.4.2 10.2 < 10.2.6 10.0 < 10.0.9 9.4 < 9.4.13 9.3 < 9.3.14
References
Credits
🔍 Aobo Wang (@M4x_1997) 🔍 Gabriel Nitu, Splunk