CVE-2026-76344

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user without admin or power roles can write dispatch metadata to an arbitrary location on the host. This occurs because the software fails to validate the search identifier before using it to create a dispatch directory. An attacker can exploit this by providing a crafted search identifier to a Representational State Transfer (REST) API endpoint, which may compromise system integrity.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.