CVE-2026-76323

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A flaw in the Job Details dashboard allows users without admin or power roles to bypass Search Processing Language (SPL) safeguards for risky commands. The issue occurs because the dashboard fails to correctly neutralize a caller-supplied search identifier before incorporating it into SPL searches. An attacker can exploit this by tricking an authenticated user into opening a crafted Job Details dashboard link via phishing. If successful, the injected SPL executes with the permissions of the victim, potentially granting unauthorized access to data and compromising system integrity.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.