CVE-2026-76319

CVE-2026-76319 is a capability bypass in Splunk's Federated Search that merits attention despite its low EPSS (0.00379). The vulnerability scores 8.8 CVSS because it allows a low-privileged user with access to Federated Search to execute searches with elevated privileges by leveraging a dispatch path that never checks for the fsh_manage capability. This isn't an injection flaw — it's a structural gap between what the RBAC model defines and what the execution flow enforces. The fsh_manage capability governs administrative operations on federated providers, and Splunk's documentation correctly identifies it as the control point. But the dispatch mechanism that actually executes federated searches — specifically the bundle selection logic that determines which configurations get loaded — operates without verifying this capability exists. If an attacker can influence bundle selection (the exploit vector), they can inject malicious content that runs in the dispatch's elevated context, achieving RCE. Three things defenders should examine. First, verify whether any users with standard roles have Federated Search access in your deployment — that's the prerequisite attack surface. Second, review your Splunk version against the patch release; this class of vulnerability has appeared before (CVE-2021-27XX, CVE-2023-15), suggesting the pattern is structural rather than isolated. Third, treat the Federated Search documentation as guidance, not enforcement — the capability model described there clearly wasn't wired into every execution path. The EPSS profile indicates this is unlikely to be exploited in the wild, but that reflects deployment rarity, not severity. Federated Search is an enterprise interconnect layer; organizations running it are managing multi-system architectures where this bypass becomes a high-value post-compromise escalation path. The real concern isn't opportunistic exploitation — it's an insider or attacker who already has Splunk access hitting a forgotten enforcement seam that nobody remembered to harden.

Reviewed through automated stages and approved by a human before publication.