High 7.7Published Oct 7, 2026

CVE-2026-76266Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise

Updated under an hour ago (2026-10-19 06:20 UTC)

Does this affect you?

It affects Splunk Enterprise and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.12%, higher than 2% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Splunk Enterprise

Exploited in the last 30 days

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-269
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.12% (percentile 2)
Assigned by: cisco
NVD analysis: Analyzed
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Splunk Splunk Enterprise splunk:enterprise (from the name)	from 10.4 before 10.4.3; from 10.2 before 10.2.7; from 10.0 before 10.0.10; from 9.4 before 9.4.15	CNA record
splunk splunk splunk:splunk	from 9.4.0 before 9.4.15; from 10.0.0 before 10.0.10; from 10.2.0 before 10.2.7; from 10.4.0 before 10.4.3	NVD

References

https://advisory.splunk.com/advisories/SVD-2026-1001vendor-advisory, mitigation

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.