Description

In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:25.090Z",
  "pubdate": "2026-08-19T22:17:25.090Z",
  "executiveSummary": "An improper access control vulnerability exists in Splunk Enterprise Security versions below 8.6.1, specifically within the User and Entity Behavior Analytics (UEBA) application metadata. The vulnerability stems from overly permissive access controls that grant users holding the ess_analyst role write permissions to search macros that should be strictly restricted to administrator roles.\nAn authenticated attacker possessing the ess_analyst role can leverage this flaw to modify search macros utilized by scheduled searches running with administrative privileges. Successful exploitation allows unauthorized access to sensitive data and compromise of system integrity through the execution of arbitrary search logic under elevated security contexts.\nThe risk implication is severe, as it permits lateral privilege escalation from a standard analyst role to full administrative data access via underlying scheduled background jobs. Mitigation requires updating Splunk Enterprise Security to version 8.6.1 or later, or manually correcting the underlying metadata and permissions associated with the vulnerable UEBA search macros.",
  "technicalDetails": "The vulnerability is rooted in incorrect authorization metadata defined within the UEBA application package for Splunk Enterprise Security. Specifically, access control lists (ACLs) assigned to specific search macros incorrectly grant write capabilities to the ess_analyst role, bypassing the principle of least privilege.\nIn Splunk Enterprise Security, scheduled searches frequently execute with administrator permissions to aggregate, analyze, and process organization-wide telemetry. Many of these privileged scheduled searches rely on shared search macros to define their underlying query parameters, logic, or filtering criteria.\nBecause users assigned the ess_analyst role are granted unintended write access to these shared search macros via the misconfigured UEBA app metadata, an attacker with ess_analyst privileges can directly alter the macro definitions.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user identifies a search macro associated with a privileged scheduled search that is modifiable due to the flawed ACLs. Second, the user modifies the macro definition to inject malicious search operators, data exfiltration logic, or broader retrieval parameters. Third, when the scheduled search executes automatically with administrative privileges, it evaluates the modified macro rather than the intended baseline configuration. Finally, the execution under the administrative context permits unauthorized access to sensitive datasets, logs, or system states that the ess_analyst role would not normally be authorized to query directly.\nThe vulnerable components are the UEBA search macros and application metadata within Splunk Enterprise Security versions below 8.6.1. Exploitation requires authenticated access with the ess_analyst role and does not require network exposure beyond standard access to the Splunk instance."
}