CVE-2026-76254

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Enterprise versions prior to 9.3.14

Description An unauthenticated user can trick an authenticated user into opening a crafted link to dispatch arbitrary Search Processing Language (SPL) pipelines via the Dataset Explorer. This occurs because the Dataset Explorer fails to validate or escape dataset names when constructing SPL searches and does not apply safeguards for risky commands. Successful exploitation allows the attacker to operate with the privileges of the tricked user, potentially granting access to sensitive data, compromising system integrity, and affecting system availability.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later. Update to version 9.3.14 or later.