CVE-2026-76321

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can inject arbitrary Search Processing Language (SPL) into requests used to search for events near a selected event. This occurs because Splunk Web fails to consistently escape caller-supplied values when constructing SPL for these searches, and embedded report access processes these requests without the required authorization checks, potentially leading to unauthorized search execution.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.