CVE-2024-36986

CVE-2024-36986 is a medium-severity vulnerability affecting Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207. An authenticated user can bypass SPL safeguards in the Analytics Workspace to execute risky commands with higher-privileged user permissions. This requires user interaction, as the attacker must phish the victim into initiating a browser request. The CVSS score is 5.7 (Medium), indicating a network-based attack with low complexity and user interaction, potentially leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.