CVE-2026-76330

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can trick an authenticated user into opening a crafted link to the Monitoring Console. This occurs because the Monitoring Console fails to sufficiently validate data used to build forwarder dashboard searches. Consequently, Splunk Enterprise executes attacker-controlled Search Processing Language (SPL), which is a proprietary language used for searching and analyzing data in Splunk, using the permissions of the authenticated user. This allows the injected SPL to access data and perform actions available to that user. Exploitation requires the attacker to phish the user into clicking the crafted link.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later.