# CVE-2026-76388: Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security

> CVE-2026-76388: Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security. CVSS 8.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76388
Last updated: 2026-08-25T16:29:47Z

- Published: 2026-08-19 21:35 UTC · Updated: 2026-08-25 16:29 UTC · Assigner: cisco
- CVSS: 8.1 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.35%, 28th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-732

## Description

In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess\_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk Enterprise Security

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76388)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76388)
- [https://advisory.splunk.com/advisories/SVD-2026-0807](https://advisory.splunk.com/advisories/SVD-2026-0807)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76388 · Markdown: https://rewindex.com/cve/CVE-2026-76388.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76388 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:06:18.161Z