Description

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:13.927Z",
  "pubdate": "2026-08-19T22:17:13.927Z",
  "executiveSummary": "A privilege abuse vulnerability exists in Splunk Enterprise for Windows due to insecure port binding behavior during the service startup sequence.\nThe vulnerability allows a local attacker to intercept sensitive authentication tokens generated by child processes by preemptively binding to the management port.\nAffected products include Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14.\nSuccessful exploitation compromises system integrity and data confidentiality by granting unauthorized access to all relevant data and system resources accessible via the security context of the user account running Splunk Enterprise.\nAttacker capabilities require local access to the Windows host and the ability to execute code or bind to network ports prior to the initialization of the Splunk Enterprise service.\nThe risk implication is severe, as local privilege boundaries can be bypassed to compromise the primary administrative context of the application.",
  "technicalDetails": "The root cause of the vulnerability stems from the Windows management-port listener failing to apply exclusive address binding protections prior to the service initiating its startup sequence.\nThe vulnerable component is the Windows management-port listener mechanism within Splunk Enterprise for Windows across affected versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14.\nPrivilege requirements dictate that the attacker must be a local user with interactive or programmatic access to the Windows host operating system.\nAuthentication requirements for the initial attack vector are non-existent locally, as the attacker leverages pre-existing local host access.\nNetwork exposure is localized to the Windows host environment where the management port listener resides.\nThe attack flow proceeds as follows: First, a malicious local user with access to the Windows host monitors or anticipates the startup sequence of Splunk Enterprise. Second, prior to the legitimate service initializing and binding to its designated management port, the attacker binds a malicious listener to that exact management port. Third, as Splunk Enterprise starts, child processes attempt to communicate or transmit authentication tokens to the management port. Fourth, the attacker's malicious listener intercepts these authentication tokens. Finally, the attacker utilizes the intercepted tokens to impersonate the service or authenticate against the management interface, leading to subsequent payload behavior that compromises all relevant data and system integrity available to the user account running Splunk Enterprise.\nPost-exploitation impact includes full administrative compromise of the Splunk Enterprise application context, unauthorized data access, and potential escalation of operational disruption based on the privileges assigned to the Splunk service account."
}