In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted loo…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 7, 2026 · NIST NVD

   Detected

   In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

2. Oct 14, 2026 · NIST NVD

   Updated

   In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

Affected

• cpe splunk/splunkversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-76264

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-76264

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-76264

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configu

  nvd.nist.gov

References

• Vendor Advisory · advisory.splunk.com