CVE-2026-76329

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can execute attacker-controlled Search Processing Language (SPL) by tricking a user with the admin role into clicking a crafted link to the Monitoring Console. This occurs because the Monitoring Console fails to sufficiently validate data used to construct dashboard searches. Successful exploitation allows the attacker to use the admin user's permissions to expose sensitive data or modify lookup data. This issue requires a phishing attack to succeed.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.