CVE-2026-76318

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with the schedule search capability can store a malicious script within an alert trigger condition field. This occurs because Splunk Web fails to escape special characters when using the alert threshold value in the generated markup. If another user opens a crafted link, the script executes in their browser, potentially allowing access to all data available to that user.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.