Privilege escalation via pre-start port binding

Privilege escalation in Splunk Enterprise for Windows allows local users to steal service tokens via the management port. In versions 10.4 before 10.4.2, 10.2 before 10.2.6, 10.0 before 10.0.9, 9.4 before 9.4.13, and 9.3 before 9.3.14, the Windows management-port listener does not reserve the port exclusively before startup, so a local process can bind it first and receive child-process authentication tokens. Exploitation requires access to the Windows host and grants the data and integrity access available to the account running Splunk Enterprise, with no published evidence of impact beyond that account.