All vulnerabilities
CVE-2026-76266

Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise

Splunk Splunk EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.4.3Also 10.2.7, 10.0.10 and 1 moreCVE List
Published7 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.

Text from CVE List

Affected versions 4

  • Splunk Enterpriseaffected: 10.4 before 10.4.3CVE List
  • Splunk Enterpriseaffected: 10.2 before 10.2.7CVE List
  • Splunk Enterpriseaffected: 10.0 before 10.0.10CVE List
  • Splunk Enterpriseaffected: 9.4 before 9.4.15CVE List

References 1