In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2026-1001 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Oct 2026, 12:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://advisory.splunk.com/advisories/SVD-2026-1001 - Vendor Advisory | |
| CPE | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* | |
| First Time |
Splunk splunk
Splunk |
07 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-07 21:17
Updated : 2026-10-14 12:03
NVD link : CVE-2026-76277
Mitre link : CVE-2026-76277
CVE.ORG link : CVE-2026-76277
JSON object : View
Products Affected
splunk
- splunk
CWE
CWE-20
Improper Input Validation