CVE-2026-76316

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user with access to the management port can perform a Search Processing Language (SPL) injection. This occurs because Deployment Server client identifiers are inserted into dispatched searches without neutralizing special characters. An attacker can register a crafted client identity to store an SPL pipeline that executes when an administrator opens the Add Data forwarder workflow. This could lead to unauthorized data access, compromised system integrity, and impact the availability of the platform instance.

Recommendations Update to version 10.4.1 or later. Update to version 10.2.5 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.