CVE-2026-76387

CVE-2026-76387 is an SPL injection in Splunk Enterprise Security's Analyst Queue that allows a read-only role (mc_investigation_read) to bypass RBAC and execute malicious search logic in elevated scheduled search contexts. The injection point is filter field names in Analyst Queue search filters — user-supplied field names get incorporated into scheduled searches that run with privilege levels far exceeding the initiating user's permissions. The result is a High Confidentiality and High Integrity impact that far exceeds what the mc_investigation_read capability should permit. The analytically significant aspect is not the injection itself but the capability-to-impact pathway it reveals. Splunk's RBAC design assumes read capabilities cannot be leveraged for unauthorized data access — this CVE breaks that assumption. Scheduled searches in Enterprise Security handle correlation searches, threat intel lookups, and incident data. When a low-privilege user's SPL injects into that elevated context, they access whatever those searches federate, not just investigation-scoped data. Treat this as a confirmation of a recurring pattern, not an isolated incident. Splunk has patched SPL injection through user-controlled field names in elevated search contexts at least twice in the 7.x series. Each patch was local to the specific injection point; the architectural pattern — dynamic SPL construction mixing elevated contexts with unsanitized user input — remained intact. Unless Splunk refactored the macro and filter system to use validated parameterized construction throughout ES, similar injection points likely exist in other Analyst Queue workflows. Immediate actions: First, audit which roles hold mc_investigation_read and whether Analyst Queue search filters accept user-supplied field names in your deployment. Second, review scheduled searches associated with Analyst Queue and determine what privilege context they run under — if it's an ES role or builtin with broad data access, the injection potentially reaches sensitive correlation and threat intel data. Third, monitor for scheduled searches executing SPL that originates from Analyst Queue filter inputs, as that would indicate active exploitation. The EPSS score of 0.00278 is low not because impact is minor, but because exploitation requires specific knowledge of Analyst Queue workflows — a low-discovery, high-severity scenario that is attractive to targeted attackers who have done their homework.

Reviewed through automated stages and approved by a human before publication.