CVE-2026-76349

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user can trick an authenticated user into executing arbitrary Search Processing Language (SPL) commands with the permissions of that authenticated user via a crafted Splunk Web link. This occurs because Splunk Web substitutes form token values provided through the Uniform Resource Locator (URL) into SPL searches without proper neutralization. Successful exploitation allows access to all relevant data and requires the attacker to phish the user into opening the malicious link.

Recommendations Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.