CVE-2026-76332

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can trick an authenticated user into opening a crafted link to Analytics Workspace. This occurs because Analytics Workspace does not sufficiently validate data used to build searches, allowing the execution of attacker-controlled Search Processing Language (SPL) with the permissions of the authenticated user. The injected SPL can be used to access data and perform actions available to that user. Exploitation requires the attacker to phish the user into clicking the link.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.