HIGHpublic-safe

CVE-2026-76266

NVD: In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system... NVD: The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. NVD: The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation.

CVSS
7.7 Severity
HIGH EPSS
0.0012 (2) KEV
-

Source-published summary

Possible impact

Source describes admin privilege risk · local exposure. Possible impact: A local user may gain root or administrative-level privileges on affected systems.

Affected context

vendor/product: splunk / splunk; affected version context: -

Remediation / advisory

Patch confirmed by source text; fixed version context: occur, run.

Why it matters

Source describes admin privilege risk · local exposure. Possible impact: A local user may gain root or administrative-level privileges on affected systems.; CVSS 7.7 (HIGH); EPSS percentile 2; not listed in KEV; Patch confirmed by source text; fixed version context: occur, run; sources: NVD, Vendor Advisory.

What to verify

Confirm affected product/version, vendor advisory, patch or mitigation, and exposure.

Exposure hint

local exposure

Impact tags

admin privilege risklocal exposure relevant

Urgency reasons

CVSS HIGHaffected product presentvendor advisory presentrecent updateremediation reference present

Source-derived note

Summary derived from NVD / Vendor Advisory description; unsafe procedural detail is not shown.

Redaction metadata

source summary used: True
fallback summary used: False
unsafe procedural detail present: false
raw source displayed: false
public summary redacted: true

Remediation handoff

Public-safe static handoff for human/Codex remediation planning. Scan, patch, external execution, and auto remediation are disabled.

Handoff JSON Handoff Markdown Safe Codex prompt

Safety note

This radar shows source-published defensive context only. Exploit procedures, exploit strings, scanner commands, and auto-remediation are not provided.