---
id: CVE-2026-76264
title: >-
  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a
  user who does not hold the "admin" or "power" Splunk roles could create or
  edit scripted lookup definitions through raw configuration endpoints
summary: >-
  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a
  user who does not hold the "admin" or "power" Splunk roles could create or
  edit scripted lookup definitions through raw configuration endpoints. The
  vulnerability…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: splunk
product: splunk
affected:
  - 'splunk >= 9.4.0, < 9.4.15'
  - 'splunk >= 10.0.0, < 10.0.10'
  - 'splunk >= 10.2.0, < 10.2.6'
  - 'splunk >= 10.4.0, < 10.4.2'
patched:
  - splunk 10.4.2
published: '2026-10-07'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T12:25:05.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76264'
references:
  - url: 'https://advisory.splunk.com/advisories/SVD-2026-1001'
    label: psirt@cisco.com
tags:
  - nvd
  - cve.org
epss: 0.00222
epssPercentile: 0.12744
ingestedAt: '2026-10-07T21:54:15.092Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-10T02:44:20.249009Z'
---

## Overview

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

## Affected

- `splunk >= 9.4.0, < 9.4.15`
- `splunk >= 10.0.0, < 10.0.10`
- `splunk >= 10.2.0, < 10.2.6`
- `splunk >= 10.4.0, < 10.4.2`

## Remediation

Upgrade past the affected range:

- `splunk 10.4.2`