Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363938);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id(
    "CVE-2026-76266",
    "CVE-2026-76265",
    "CVE-2026-76269",
    "CVE-2026-76280",
    "CVE-2026-76272",
    "CVE-2026-76273",
    "CVE-2026-76275",
    "CVE-2026-76279",
    "CVE-2026-76277"
  );
  script_xref(name:"IAVA", value:"2026-A-1105");

  script_name(english:"Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Splunk Enterprise installed on the remote host is 9.4.x prior to 9.4.15, 10.0.x prior to 10.0.10, 10.2.x
prior to 10.2.7, or 10.4.x prior to 10.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the
SVD-2026-1001 advisory, including:

  - On Linux, a local user who can run commands as the account running Splunk Enterprise could cause an
    affected Linux package upgrade to run attacker-controlled operating system commands with root privileges.
    (CVE-2026-76266)

  - A user who does not hold the admin or power roles could access privileged Splunk Secure Gateway REST API
    functionality and cause it to sign attacker-controlled payloads. (CVE-2026-76265)

  - A user who does not hold the admin or power roles could use a user-controlled job identifier to access
    search job information, including query text and results, belonging to other users. (CVE-2026-76269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2026-1001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to version 9.4.15, 10.0.10, 10.2.7, 10.4.3, or later. For CVE-2026-76265, CVE-2026-76272,
and CVE-2026-76280, upgrade Splunk Secure Gateway to version 3.8.72, 3.9.25, 3.10.11, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76265");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-76266");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(639, 732, 862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.15', 'license' : 'Enterprise' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.10', 'license' : 'Enterprise' },
  { 'min_version' : '10.2.0', 'fixed_version' : '10.2.7', 'license' : 'Enterprise' },
  { 'min_version' : '10.4.0', 'fixed_version' : '10.4.3', 'license' : 'Enterprise' }
];
vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);