CVE-2026-76259 is a local privilege escalation vulnerability in Splunk Enterprise for Windows. It allows a local user with access to the Windows host to bind to Splunk's management port before the Splunk service starts, then intercept authentication tokens from child processes as they start up.

The root cause is that the Windows management-port listener does not apply exclusive address-binding protections before the service starts, leaving a window in which another local process can claim the port. An attacker who captures these tokens can use them to compromise the integrity and confidentiality of all data and services managed by that Splunk instance.

The following version(s) are affected:

Splunk Enterprise for Windows below 10.4.2, 10.2.6, 10.0.9, 9.4.13 and 9.3.14 – (Affected)

Splunk Enterprise for Windows 10.4.2, 10.2.6, 10.0.9, 9.4.13, 9.3.14 and later – (Not affected, patched)

This vulnerability affects the Windows build of Splunk Enterprise only; Splunk Enterprise on Linux/Unix hosts is not affected. Administrators should verify their installed version and platform against Splunk's August 2026 Security Hardening Release (SVD-2026-0801).

Typical attack flow:

Step 1 - Race the management-port listener

A local user or process on the Windows host binds to Splunk's management port before the Splunk service itself starts and claims it.

Step 2 - Intercept authentication tokens

As Splunk child processes start up and attempt to authenticate to the management port, the attacker-controlled listener captures their tokens.

Attack vectors:

• Local access to the Windows host running Splunk Enterprise (no remote network exploitation).
• Timing the local process to bind the management port ahead of the Splunk service, e.g. at host boot or service restart.

Successful exploitation may allow attackers to:

• Obtain valid Splunk authentication tokens without needing existing Splunk credentials.
• Use those tokens to compromise the confidentiality and integrity of all data and system functions the Splunk instance manages.

CERTVU recommends the following:

1. Upgrade Splunk Enterprise for Windows

   Upgrade to Splunk Enterprise for Windows 10.4.2, 10.2.6, 10.0.9, 9.4.13, 9.3.14 or later, per Splunk's August 2026 Security Hardening Release (SVD-2026-0801).

2. Apply least privilege on the host

   Ensure the account running the Splunk service, and any other local accounts on the host, hold only the privileges needed for their role, reducing the pool of local processes that could contest the management port.

3. Restrict local logon rights

   Limit which accounts can log on locally or run processes on the Windows host running Splunk Enterprise, since exploitation requires local access.

4. Audit the estate for the affected product

   Identify every Windows host running Splunk Enterprise and confirm each is patched or scheduled for patching.

5. Monitor Splunk's security advisories page for further updates

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.