{"id":"CVE-2026-76277","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-76277","generatedAt":"2026-10-28T03:58:10.199Z","title":"The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory.","description":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.","published":"2026-10-07T21:17:19.000Z","lastModified":"2026-10-14T12:03:46.000Z","status":"Analyzed","sourceIdentifier":"psirt@cisco.com","cvss":{"version":"3.1","score":4.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"},"cwe":["CWE-20"],"affected":["splunk/splunk"],"epss":{"score":0.00244,"percentile":0.15573,"date":"2026-10-27","history":[{"date":"2026-10-08","score":0.00183,"percentile":0.07215}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-07T21:17:19.000Z","detail":{"score":"4.1","severity":"MEDIUM","publishedAt":"2026-10-07T21:17:18.900Z"},"summary":"New CVE, medium severity (CVSS 4.1)."}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-1001","tags":["Vendor Advisory"],"source":"psirt@cisco.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76277","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}