The version of Splunk Enterprise installed on the remote host is 9.4.x prior to 9.4.15, 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.7, or 10.4.x prior to 10.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SVD-2026-1001 advisory, including:

  - On Linux, a local user who can run commands as the account running Splunk Enterprise could cause an     affected Linux package upgrade to run attacker-controlled operating system commands with root privileges.
    (CVE-2026-76266)

  - A user who does not hold the admin or power roles could access privileged Splunk Secure Gateway REST API     functionality and cause it to sign attacker-controlled payloads. (CVE-2026-76265)

  - A user who does not hold the admin or power roles could use a user-controlled job identifier to access     search job information, including query text and results, belonging to other users. (CVE-2026-76269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

high Nessus Plugin ID 363938

Version 1.3