CVE-2026-76279

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15

Description Users with the run collect capability can use the collect Search Processing Language (SPL) command to write events to internal indexes that are outside the index access configured for their role. This occurs because the software fails to normalize whitespace in an index name before applying index-access restrictions.

Recommendations Update to version 10.4.3 or later. Update to version 10.2.7 or later. Update to version 10.0.10 or later. Update to version 9.4.15 or later.