CVE-2026-76336: Splunk SPL2: broken authZ lets low-priv user wipe modules

HIGH

Published August 19, 2026

CISO Take

A missing-authorization bug in Splunk Enterprise's SPL2 module management REST API lets any authenticated user who lacks the admin or power role delete every SPL2 module across all apps and users on the instance in a single unauthenticated-by-role API call. This matters because SPL2 modules back the exported datasets and functions that feed Splunk's Machine Learning Toolkit pipelines and correlation/detection content, so a routine analyst-tier account — the kind SOC teams hand out liberally — can silently destroy shared ML-driven detection logic and cause partial service disruption instance-wide. There is no public exploit code, no Nuclei template, and the CVE isn't in CISA KEV or scored by EPSS yet, but the attack requires low complexity, no user interaction, and only a low-privilege credential (CVSS 7.1, AV:N/AC:L/PR:L/UI:N). Patch to Splunk Enterprise 10.4.2 or 10.2.6 (instances below 10.2 are unaffected); until then, restrict the SPL2 module management REST endpoint to admin/power roles at the network/proxy layer and audit REST API logs for DELETE calls against SPL2 modules from non-privileged accounts.

Sources:NVDadvisory.splunk.comATLAS

What is the risk?

High severity (CVSS 7.1) driven by a trivial exploitation path: network-reachable, low attack complexity, no user interaction, and only low privileges required — meaning any standard analyst account, not just admin/power roles, can trigger it. Impact is confidentiality-neutral but integrity-high and availability-low: the flaw destroys shared configuration/data artifacts (SPL2 modules) rather than exposing data or crashing the service outright. No public PoC, scanner template, KEV listing, or EPSS score exists yet since the advisory is fresh (published 2026-08-19), so likelihood of opportunistic mass exploitation is currently low, but insider-threat and compromised-low-priv-account scenarios are realistic given how common broad Splunk seat access is in SOC/MSSP environments.

How does the attack unfold?

Initial Access

Attacker obtains or compromises a low-privileged Splunk account lacking admin or power roles (e.g., phished analyst credential or scoped API token).

AML.T0012

Exploitation

Attacker calls the SPL2 module management REST API's deletion endpoint, which fails to sufficiently authorize or validate the request against the caller's role.

Impact

All SPL2 modules across every app and user on the instance are deleted, destroying exported datasets and functions used by ML-driven detection pipelines and causing partial service disruption.

AML.T0059

Initial Access

Attacker obtains or compromises a low-privileged Splunk account lacking admin or power roles (e.g., phished analyst credential or scoped API token).

AML.T0012

Exploitation

Attacker calls the SPL2 module management REST API's deletion endpoint, which fails to sufficiently authorize or validate the request against the caller's role.

Impact

All SPL2 modules across every app and user on the instance are deleted, destroying exported datasets and functions used by ML-driven detection pipelines and causing partial service disruption.

AML.T0059

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ALow

What should I do?

1 step

Patch to Splunk Enterprise 10.4.2+ or 10.2.6+ (versions below 10.2 are not affected and don't need remediation for this issue). Until patched, restrict access to the SPL2 module management REST API endpoints to admin/power-role accounts only via reverse proxy or network ACL, and review authorize.conf to confirm module deletion capabilities aren't inadvertently granted to broader roles. Detection: audit Splunk's internal REST API access logs (_internal/_audit indexes) for DELETE requests against SPL2 module endpoints originating from accounts without admin or power roles, and treat any hits as potential exploitation requiring module/dataset restoration from backup.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassDoSTraining DataAML.T0012- Valid Accounts AML.T0059- Erode Dataset Integrity

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Annex A.7-Data for AI systems

NIST AI RMF

MANAGE-Manage AI risks from data and access control failures

Frequently Asked Questions

What is CVE-2026-76336?

Is CVE-2026-76336 actively exploited?

No confirmed active exploitation of CVE-2026-76336 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-76336?

Patch to Splunk Enterprise 10.4.2+ or 10.2.6+ (versions below 10.2 are not affected and don't need remediation for this issue). Until patched, restrict access to the SPL2 module management REST API endpoints to admin/power-role accounts only via reverse proxy or network ACL, and review `authorize.conf` to confirm module deletion capabilities aren't inadvertently granted to broader roles. Detection: audit Splunk's internal REST API access logs (`_internal`/`_audit` indexes) for DELETE requests against SPL2 module endpoints originating from accounts without admin or power roles, and treat any hits as potential exploitation requiring module/dataset restoration from backup.

What systems are affected by CVE-2026-76336?

This vulnerability affects the following AI/ML architecture patterns: ML/analytics data pipelines, SIEM-integrated detection content, feature/dataset engineering pipelines.

What is the CVSS score for CVE-2026-76336?

CVE-2026-76336 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

ML/analytics data pipelinesSIEM-integrated detection contentfeature/dataset engineering pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0059Erode Dataset Integrity

Compliance Controls Affected

ISO 42001: Annex A.7

NIST AI RMF: MANAGE

What are the technical details?

Original Advisory

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service disruption. The vulnerability does not affect Splunk Enterprise versions below 10.2. The vulnerability is possible because the SPL2 module management REST API does not sufficiently authorize and validate module deletion requests. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation.

Exploitation Scenario

An adversary obtains or compromises a routine, non-admin Splunk account — for example a phished SOC analyst credential or a scoped API token issued for a dashboard integration — and calls the SPL2 module management REST API's deletion endpoint directly. Because the endpoint fails to sufficiently authorize the request against the caller's role, the deletion succeeds and removes all SPL2 modules across every app and user on the instance, including exported datasets and functions underpinning ML-based correlation searches and MLTK pipelines, producing an immediate loss of detection content and partial service disruption without ever needing admin or power privileges.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.