CVE-2026-76311

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user possessing an embedded report token can download the dispatch archive for an embedded report search job. This occurs because the embedded report authorization flow fails to block dispatch archive download requests before the system begins transmitting the archive. An attacker can use the exposed session material to access relevant data and compromise the system integrity of the platform instance.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.