VDB
GCVE-110-NCSC-2026-457
GCVE-110-NCSC-2026-457
Advisory PublishedCVSS 5.9/10
In Splunk Enterprise versions prior to 10.4.4, insufficient verification in the Data Management REST API allowed users with certain roles to improperly access or delete Data Management SPL2 preview jobs and results outside their ownership when the Edge Processor feature was enabled.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyCWE-770Allocation of Resources Without Limits or ThrottlingCWE-862Missing AuthorizationCWE-94Improper Control of Generation of Code ('Code Injection')CWE-943Improper Neutralization of Special Elements in Data Query LogicCWE-352Cross-Site Request Forgery (CSRF)CWE-321Use of Hard-coded Cryptographic KeyCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-203Observable DiscrepancyCWE-424Improper Protection of Alternate PathCWE-647Use of Non-Canonical URL Paths for Authorization DecisionsCWE-552Files or Directories Accessible to External Parties
Risk Scores
CVSS 3.1
5.9/10
Medium · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Splunk | vers:unknown/* | — | — |
Aliases
CVE-2026-76287CVE-2026-76288CVE-2026-76289CVE-2026-76290CVE-2026-76291CVE-2026-76292CVE-2026-76293CVE-2026-76294CVE-2026-76295CVE-2026-76296CVE-2026-76297CVE-2026-76298CVE-2026-76299CVE-2026-76300CVE-2026-76301CVE-2026-76302CVE-2026-76303CVE-2026-76304CVE-2026-76305CVE-2026-76306CVE-2026-76307CVE-2026-76308CVE-2026-76406CVE-2026-76407CVE-2026-76408CVE-2026-76526CVE-2026-76527CVE-2026-76528CVE-2026-76529CVE-2026-76530CVE-2026-76531
References
Browse GCVE Records
858 records in the GCVE database · Updated October 29, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.