HighPublic exploit

Privilege Escalation in Splunk Enterprise and Splunk Cloud via edit_user Capability

IdentifiersCVE-2023-32707CWE-269

CVE-2023-32707 is a privilege escalation vulnerability affecting Splunk Enterprise versions earlier than 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions earlier than 9.0.2303.100. A low-privileged authenticated user assigned a role that includes the edit_user capability can escalate privileges to the admin user by sending specially crafted web requests. The flaw allows abuse of user-management functionality intended for delegated administration, resulting in unauthorized elevation from a limited role to full administrative access within the Splunk environment.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated low-privileged user to obtain administrative privileges in the affected Splunk deployment. This can result in full control of the Splunk environment, including unauthorized administrative actions, access to sensitive data managed by the platform, and increased risk of broader compromise or data breach.

Mitigation

If you can’t patch tonight, do this now.

Until patched, restrict assignment of the edit_user capability to only fully trusted administrative roles, review role configurations to remove unnecessary delegated user-management permissions, and monitor audit logs for suspicious password or user-management activity indicative of attempted privilege escalation. Limiting access to administrative web functionality and closely reviewing privileged role delegation can reduce exposure, but upgrading to fixed versions is the definitive mitigation.

Remediation

Patch, then assume compromise.

Upgrade Splunk Enterprise to version 9.0.5, 8.2.11, 8.1.14, or later, and upgrade Splunk Cloud Platform to version 9.0.2303.100 or later. Apply the vendor-provided fixes across all affected deployments and verify that no systems remain on vulnerable releases.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

splunk_privilege_escalation_cve_2023_32707.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module targeting CVE-2023-32707, a privilege escalation vulnerability in Splunk Enterprise. The exploit leverages the 'edit_user' capability assigned to a low-privileged user role, which allows the attacker to change the admin password due to improper enforcement of the 'grantableRoles' setting in Splunk's configuration. After escalating privileges, the module logs in as admin and uploads a malicious Splunk app to achieve remote code execution (RCE) on the server. The module supports both Linux/Unix and Windows targets and can deliver any Metasploit-compatible payload. The exploit interacts with Splunk's REST API endpoints over HTTPS (default port 8000, SSL enabled by default). The repository is structured as a single Ruby file within the Metasploit framework, making it a weaponized, ready-to-use exploit for penetration testers and red teamers.

Disclosed Jun 1, 2023rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SplunkSplunkapplication

SplunkSplunk Cloud Platformapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

May 14, 2026

Detection: Splunk Edit User Privilege Escalation | Splunk Security Content

A Splunk privilege escalation vulnerability involving abuse of the edit_user capability that could allow a low-privilege user to gain administrative access.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2023-32707

NVD

nvd.nist.gov/vuln/detail/CVE-2023-32707

MITRE CWE · CWE-269

cwe.mitre.org

Vendor Advisory

advisory.splunk.com/advisories/SVD-2023-0602

Vendor Advisory

research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593

Privilege Escalation in Splunk Enterprise and Splunk Cloud via edit_user Capability

IdentifiersCVE-2023-32707CWE-269