CVE-2026-76388
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Splunk Enterprise Security versions below 8.6.1, a user with the ess_analyst role could change UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is due to granting analyst roles write access to search macros that should be writable only by administrator roles.
Risk Assessment
The risk includes unauthorized data access and potential system integrity compromise by a user with the ess_analyst role.
Recommendation
It is recommended to upgrade Splunk Enterprise Security to version 8.6.1 or later and review permissions on UEBA search macros.
Other vulnerabilities in Splunk Enterprise Security
Original NVD description (English source)
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.