CVE-2026-76320

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can trick an authenticated user into executing arbitrary Search Processing Language (SPL) searches via the Event Type Builder. This occurs because the Event Type Builder accepts cross-site request input and retains values that affect SPL when constructing sample event searches. Successful exploitation requires phishing the authenticated user to initiate a request within their browser, which could lead to the exposure of stored credentials and relevant data.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.