A high-severity access control vulnerability in Splunk Enterprise allows authenticated attackers to bypass security restrictions and interact with unauthorized resources.

This is an improper access control vulnerability (CWE-284) that allows an authenticated actor to interact with resources they should not be permitted to access. The vulnerability is remotely exploitable with low complexity.

Successful exploitation can lead to unauthorized access to sensitive data or configuration settings within the Splunk platform. With a CVSS score of 8.8, this vulnerability represents a severe risk to organizational security, potentially allowing an attacker to exfiltrate information or disrupt monitoring capabilities.

Immediate Action: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher.

Proactive Monitoring: Monitor for unauthorized access attempts to restricted configuration files or sensitive indexes that should not be visible to standard users.

Compensating Controls: Implement strict Network Access Control (NAC) and restrict access to the Splunk management interface to known, trusted subnets.

Public Exploit Available: No

Administrators must prioritize the application of the provided security updates to address this access control weakness. Failure to remediate this issue could allow authenticated malicious actors to bypass established security boundaries, leading to unauthorized data exposure.