CVE-2026-76273

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15

Description An issue exists where a user with the run collect capability can use the collect Search Processing Language (SPL) command to insert attacker-controlled content into system-level messages. This occurs because the collect command fails to validate the index name before processing the value.

Recommendations Update to version 10.4.3 or later. Update to version 10.2.7 or later. Update to version 10.0.10 or later. Update to version 9.4.15 or later.