The vulnerability occurs when a local user with the ability to execute commands as the Splunk Enterprise service account initiates an upgrade of the Linux package containing Splunk. The package maintainer script that runs with root privileges mistakenly trusts content from the existing Splunk installation, allowing the attacker to inject OS commands that execute as root. This can compromise the entire system, providing full control over the host where Splunk is installed. The weakness is an improper authorization flaw, identified as CWE-269.

Splunk Enterprise installations running on Linux versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable. A local user who can run commands as the Splunk service account and who can trigger an upgrade on the affected package is required to exploit the flaw.

The CVSS score of 7.7 indicates a high severity vulnerability. The EPSS score is currently not available, and the flaw is not listed in the CISA KEV catalog. Because exploitation requires a local user who already has some level of interaction with the system, the attack vector is inferred to be local privilege escalation. If a local attacker can modify the Splunk installation and then trigger an upgrade, root‑level control is achievable, making the risk highly significant for compromised hosts.