Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Scores

EPSS (exploitation in 30 days)

0.24% · top 84% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.1.

Weakness

• CWE-20: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• Splunk · Splunk Enterprise

  • affected 10.4 – < 10.4.3
  • affected 10.2 – < 10.2.7
  • affected 10.0 – < 10.0.10
  • affected 9.4 – < 9.4.15

What to do

Solution: Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher.

References (1)

• https://advisory.splunk.com/advisories/SVD-2026-1001 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-76277](https://trackcve.app/badge/CVE-2026-76277.svg)](https://trackcve.app/cve/CVE-2026-76277)

Record last updated 8 Oct 2026, 15:06 UTC.