CVE-2026-76341

The CVSS 5.4 assigned to this privilege escalation fundamentally misrepresents the risk. A power user with access to Table Editor can embed malicious SPL in a shared dataset during initial data preparation — a context where SPL safeguards are not applied. When any administrator opens that dataset in Table Editor, the SPL executes with full admin privileges. The attacker never needs the admin's credentials; they borrow admin authority without authentication. The 'phishing required' framing in the CVE description obscures the actual blast radius. An attacker pays the social engineering cost once to get a power-level account, seeds a malicious dataset into shared infrastructure, and then every admin who opens Table Editor for legitimate work becomes an unwitting execution trigger. This is not a one-to-one phishing matchup — it's a one-to-many blast with persistent presence. The damage (full admin access on the search head, data exposure across indexed content, limited data modification) is entirely unconstrained by the initial access requirement. This vulnerability is not an isolated flaw — it's a manifestation of Splunk's additive SPL safeguard architecture. Safeguards must be explicitly invoked in each new data handling context rather than applied by default. Table Editor's initial data preparation is simply the latest discovered gap in that pattern. If other data preparation contexts invoke SPL without applying the same checks, they carry the same vulnerability. The EPSS score of 0.00227 likely reflects detection failure rather than genuine rarity: the malicious SPL executes as routine administrative workflow, producing no failed logins, no anomalous query patterns, and no command that looks malicious in isolation. Prioritize auditing Splunk deployments for other data preparation contexts that invoke SPL. Review which power users can create and share datasets. Implement logging for Table Editor dataset access, especially from admin accounts, and treat any unexpected SPL execution in that context as high-fidelity evidence of this attack vector.

Reviewed through automated stages and approved by a human before publication.