The vulnerability is a flaw in Splunk Enterprise that allows an attacker to bypass intended access controls, granting unauthorized access to data or functionality, as identified in the Cisco internal review and classified under CWE-284. Because the flaw can allow an attacker to bypass intended restrictions, it could lead to theft or modification of sensitive information, or elevation of privileges within the Splunk deployment.

Splunk Enterprise builds that have not incorporated the fixes released in versions 10.4.3, 10.2.7, 10.0.10, or 9.4.15 are potentially vulnerable. The advisory does not enumerate explicitly which older revisions remain affected, but any deployment running code that predates these patches should be evaluated for risk.

Although the EPSS score is < 1% and the CVSS score is not available, the flaw’s inherent nature as an improper access control mechanism allows an attacker who has network access to the Splunk deployment to bypass normal authorization checks. This could enable the attacker to read or modify data, or perform actions beyond the intended privilege level.