CVE-2026-76327

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway versions prior to 3.9.23 Splunk Secure Gateway versions prior to 3.8.70

Description An unauthenticated user can trick a user with admin or sc admin roles into opening a crafted Splunk Web URL. This allows the execution of arbitrary Search Processing Language (SPL) commands—a proprietary language used by Splunk for searching and analyzing data—using the permissions of the tricked user. This can lead to the exposure of sensitive data or the modification of search results and lookup data. The issue occurs because Splunk Secure Gateway dashboards fail to correctly neutralize caller-supplied values before incorporating them into dashboard searches. Exploitation requires a phishing attack to induce the targeted user to initiate the request via their browser.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.9 or later. Update Splunk Secure Gateway to version 3.9.23 or later. Update Splunk Secure Gateway to version 3.8.70 or later.