CVE-2026-76339

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description Insufficient input validation in the geostats command allows a user without admin or power roles to inject arbitrary Search Processing Language (SPL) commands. This issue can be exploited by tricking an authenticated user into initiating a malicious request via phishing in Splunk Web. The injected SPL executes with the permissions of the victim user, potentially exposing sensitive data, including stored credentials, and allowing the modification of lookup files that the victim has permission to change.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later. As a temporary mitigation, restrict the use of the geostats command for users without administrative privileges.