Cyber Resilience

CVE-2026-76388

Splunk Enterprise Security ≤ 8.6.1

Published
19 August 2026
Modified
25 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0025 16th percentile
Risk Priority 58 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-76388 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Splunk Enterprise Security. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Executable Installer File Permissions Weakness (T1574.005); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant…

more

data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.

CWE(s)
CWE-732

Related Threats

MITRE ATT&CK Enterprise Techniques

T1574.005 Executable Installer File Permissions Weakness Stealth
Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.
attack.mitre.org →
T1574.010 Services File Permissions Weakness Stealth
Adversaries may execute their own malicious payloads by hijacking the binaries used by services.
attack.mitre.org →
T1505.005 Terminal Services DLL Persistence
Adversaries may abuse components of Terminal Services to enable persistent access to systems.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
T1554 Compromise Host Software Binary Persistence
Adversaries may modify host software binaries to establish persistent access to systems.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-76387Same product: Splunk Enterprise Security
CVE-2024-22165Same product: Splunk Enterprise Security
CVE-2024-22164Same product: Splunk Enterprise Security
CVE-2025-20387Same vendor: Splunk
CVE-2025-20233Same vendor: Splunk
CVE-2026-76399Same vendor: Splunk
CVE-2025-20298Same vendor: Splunk
CVE-2025-20386Same vendor: Splunk
CVE-2026-34352Shared CWE-732
CVE-2023-49580Shared CWE-732

Affected Assets

splunk
enterprise security
≤ 8.6.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces the access control policy that defines permissions on resources, thereby stopping incorrect assignments from remaining exploitable.

AC-6 Least Privilege good match

Directly requires assignment of only the minimum necessary permissions, preventing overly broad grants on critical resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 partial match
prevents

Directly requires defining, enforcing, and reviewing access permissions and least privilege on resources.

PR.PS-01 partial match
prevents

Hardened baselines and configuration management explicitly include correct permission settings for critical resources.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.1 Policies for information security partial match
prevents

Topic-specific policies on asset management and secure configuration establish expectations for correct permission settings on critical resources, lowering the likelihood that default or overly permissive permissions will be left in place.

A.5.12 Classification of information partial match
prevents

Classification results drive the assignment of permissions and handling procedures, decreasing the likelihood that critical resources receive incorrect or overly permissive permission settings.

A.5.15 Access control partial match
prevents

By requiring owners to determine and document the exact permissions needed for each asset, the control reduces the likelihood that default or overly permissive file and resource permissions will be left in place.

A.5.18 Access rights partial match
prevents

Documented provisioning and revocation procedures reduce the chance that critical resources retain overly permissive default or leftover permissions after personnel changes.

A.5.2 Information security roles and responsibilities partial match
prevents

Documented responsibility for protecting assets encourages correct permission settings rather than leaving them at insecure defaults.

A.5.22 Monitoring, review and change management of supplier services partial match
finds

Monitoring supplier policy changes and conducting audits can reveal incorrect permission assignments on resources managed by the supplier, prompting corrective action before they are exploited.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-732
Windows Server 2016 (2 rules)
  • V-224972 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
  • V-224831 Local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2019 (2 rules)
  • V-205741 Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
  • V-205663 Windows Server 2019 local volumes must use a format that supports NTFS attributes. prevents CWE-732

References