CVE-2026-76259: Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access to the Windows host and must be able to bind the Splunk Enterprise management port before Splunk Enterprise starts. Remote-only access is not described as sufficient.
What level of access could an attacker gain?
An attacker could intercept authentication tokens from child processes and use them to compromise the data and system integrity available to the account running Splunk Enterprise. The impact therefore depends on that service account's privileges and accessible resources.
Which releases are affected?
Splunk Enterprise for Windows releases below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14 are affected. Upgrade to the applicable listed release or later.