Security Hardening Release for Splunk Enterprise - August 2026

CVE-2026-76251: Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the “admin” or “power” Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored for the app. With this access, the user could view all relevant data available to that token and make limited changes to Splunk Observability Cloud content. The vulnerability does not affect Splunk Enterprise 9.4 and 9.3 versions. The vulnerability is possible because the app’s Representational State Transfer (REST) API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests with the stored access token. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-71636

CWE: CWE-862

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Mitigations and Workarounds

Turn off or remove the Splunk App for Splunk Observability Cloud. For more information see Manage app and add-on objects in the Splunk documentation.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76252: Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user’s browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.

Bug ID: VULN-80006

CWE: CWE-79

CVSSv3.1 Score: 6.8, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76253: Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions. For more information see Create scheduled alerts, Set up alert actions, Define roles on the Splunk platform with capabilities, and Configuration file precedence in the Splunk documentation.

Bug ID: VULN-80101

CWE: CWE-269

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

Remove the rest_properties_set or schedule_search capability from custom roles that do not need to write user-specific configurations or create and dispatch scheduled searches. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

CVE-2026-76254: SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands to those searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Explore a dataset and SPL safeguards for risky commands in the Splunk documentation.

Bug ID: VULN-80098

CWE: CWE-943

CVSSv3.1 Score: 7.5, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76255: Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the “admin” or “power” Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the “admin” or “power” Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-80221

CWE: CWE-862

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76256: Information Exposure through REST API Endpoints in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the “admin” or “power” Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information through Splunk Secure Gateway Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Security Assertion Markup Language setup and instance settings REST API endpoints do not enforce authorization requirements before returning configuration information.

Bug ID: VULN-73645

CWE: CWE-200

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.9, 3.9.23, and 3.8.70, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76257: Missing Authorization through REST API Endpoints in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.

Bug ID: VULN-71722

CWE: CWE-862

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.10, 3.9.24, and 3.8.71, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76258: Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the “admin” or “power” Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-77524

CWE: CWE-321

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.10, 3.9.24, and 3.8.71, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76259: Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

Description

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.

Bug ID: VULN-77861

CWE: CWE-269

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Acknowledgments: Aobo Wang (@M4x_1997), Gabriel Nitu, Splunk

CVE-2026-76260: Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the rest_properties_get capability could read encrypted stored credentials through the Representational State Transfer (REST) API. Successful exploitation can expose relevant data protected by the stored credentials. The incorrect permission assignment is possible because the properties REST endpoint requires the rest_properties_get capability instead of the list_storage_passwords capability to read stored credentials. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-68151

CWE: CWE-732

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Acknowledgments: Fredrik Alexandersson (stok)

CVE-2026-76261: Insecure Default Access Control List through the REST API in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the “admin” or “power” Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.

Bug ID: VULN-77506

CWE: CWE-732

CVSSv3.1 Score: 5.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.9, 3.9.23, and 3.8.70, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76262: Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterprise versions below 10.4. The information disclosure is possible because the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar lacks authentication, which lets any client that can reach the sidecar retrieve the metrics without credentials. For more information see About Splunk sidecars in the Splunk documentation.

Bug ID: VULN-77887

CWE: CWE-200

CVSSv3.1 Score: 7.5, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76263: Improper Access Control through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the “admin” or “power” Splunk roles could delete Splunk Processing Language version 2 (SPL2) modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk Enterprise versions below 10.2. The broken object level authorization is possible because the data management orchestrator does not verify that the requesting user owns the target resources before it deletes the modules. For more information see Manage SPL2-based apps in the Splunk documentation.

Bug ID: VULN-81973

CWE: CWE-639

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76309: Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the “admin” or “power” Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Bug ID: VULN-86775

CWE: CWE-89

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76310: Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the “admin” Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests. For more information see Additional configuration for embedded reports and About configuring role-based user access in the Splunk documentation.

Bug ID: VULN-79295

CWE: CWE-284

CVSSv3.1 Score: 9.4, Critical

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigations and Workarounds

Turn off report embedding globally by setting allowEmbedTokenAuth = false in the server.conf configuration file if you do not use embedded report functionality. For more information see Additional configuration for embedded reports in the Splunk documentation.

CVE-2026-76311: Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports and Embed scheduled reports in the Splunk documentation.

Bug ID: VULN-80235

CWE: CWE-284

CVSSv3.1 Score: 9.4, Critical

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigations and Workarounds

Turn off report embedding globally by setting allowEmbedTokenAuth = false in the server.conf configuration file if you do not use embedded report functionality. For more information see Additional configuration for embedded reports and Embed scheduled reports in the Splunk documentation.

CVE-2026-76312: Improper Access Control through Embedded Reports in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. For more information see Additional configuration for embedded reports and Embed scheduled reports in the Splunk documentation.

Bug ID: VULN-80237

CWE: CWE-284

CVSSv3.1 Score: 9.4, Critical

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76313: Remote Code Execution (RCE) through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Representational State Transfer (REST) API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts caller-supplied knowledge bundle selections from users who do not hold that capability. For more information see What search heads send to search peers, About configuring role-based user access, Define roles on the Splunk platform with capabilities, and Using the REST API reference in the Splunk documentation.

Bug ID: VULN-80532

CWE: CWE-284

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-76314: Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect system integrity and availability. The vulnerability is possible because Splunk Web evaluates manager Extensible Markup Language expressions without sufficient input restrictions, and the associated configuration route does not require the capability expected for manager configuration changes. For more information see About configuration files in the Splunk documentation.

Bug ID: VULN-81307

CWE: CWE-94

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76315: Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability on the Splunk platform instance. The vulnerability is possible because Splunk Web Manager Configuration evaluates manager configuration values, and the Representational State Transfer (REST) API path for manager configuration does not require the permission that normally controls manager configuration writes. For more information see About configuring role-based user access and restmap.conf in the Splunk documentation.

Bug ID: VULN-79299

CWE: CWE-94

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76316: Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability of the Splunk platform instance. The SPL injection is possible because Deployment Server client identifiers are placed into dispatched searches without neutralizing special characters. Successful exploitation requires an administrator to open the affected Add Data forwarder workflow after the unauthenticated user registers a crafted Deployment Server client identity. For more information see Forward data and About agent management in the Splunk documentation.

Bug ID: VULN-80010

CWE: CWE-943

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-76317: Path Traversal through the Lookup Configuration REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could then access all relevant data and affect system integrity and availability on the search head. The vulnerability is possible because the lookup configuration endpoint does not resolve lookup source paths before checking whether they stay inside the allowed lookup staging area. For more information see About lookups and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-80099

CWE: CWE-26

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-76318: Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could access all data available to that user. The vulnerability is possible because Splunk Web uses the alert threshold value in generated alert trigger condition markup without escaping special characters. Successful exploitation requires another user to open the crafted link. For more information see Configure alert trigger conditions and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-81804

CWE: CWE-79

CVSSv3.1 Score: 5.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76319: Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Federated Search dispatch flow accepts caller-controlled bundle selection without enforcing the capability that manages federated providers and indexes. For more information see Security models for Federated Search for Splunk and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-81844

CWE: CWE-862

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-76320: SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language (SPL) searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability is possible when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Automatically find and build event types in the Splunk documentation.

Bug ID: VULN-81369

CWE: CWE-943

CVSSv3.1 Score: 5.9, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76321: SPL Injection through Nearby Event Searches in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events in the Splunk documentation.

Bug ID: VULN-81372

CWE: CWE-77

CVSSv3.1 Score: 7.3, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76322: SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “user” Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “user” Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search in the Splunk documentation.

Bug ID: VULN-81571

CWE: CWE-862

CVSSv3.1 Score: 6.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76323: SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could bypass Search Processing Language (SPL) safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity within those permissions. The vulnerability is possible because the Job Details dashboard does not correctly neutralize a caller-supplied search identifier before placing it into SPL searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The user who does not hold the “admin” or “power” Splunk roles should not be able to exploit the vulnerability at will. For more information see About jobs and job management in the Splunk documentation.

Bug ID: VULN-81905

CWE: CWE-20

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76324: Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the browser of the affected user, allowing for access to all relevant data available to that user. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web renders tour content and tour navigation links without sufficient output encoding and accepts a tour selector value that can be treated as markup. The vulnerability requires another user to open a crafted tour link. The user who holds the “power” Splunk role should not be able to trigger JavaScript execution in another user’s browser without that user interaction.

Bug ID: VULN-81907

CWE: CWE-79

CVSSv3.1 Score: 5.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76325: Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all relevant data and affect system integrity within the second user permissions. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image.

Bug ID: VULN-81908

CWE: CWE-79

CVSSv3.1 Score: 7.3, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76326: Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.

Bug ID: VULN-89255

CWE: CWE-79

CVSSv3.1 Score: 5.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76327: SPL Injection through Splunk Web in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the “admin” or “sc_admin” Splunk roles into opening a crafted Splunk Web Uniform Resource Locator (URL). The resulting dashboard searches could run arbitrary Search Processing Language (SPL) commands with the permissions available to the affected user. The commands could expose all relevant data available to that user and affect search results or lookup data. The vulnerability is possible because Splunk Secure Gateway dashboards do not correctly neutralize caller-supplied values before using them in dashboard searches. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.

Bug ID: VULN-81930

CWE: CWE-943

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.9, 3.9.23, and 3.8.70, or higher. If you can not upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

CVE-2026-76328: SPL Injection through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format (PDF) file, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Splunk Web does not sufficiently validate dashboard content before processing PDF exports. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will. For more information see Generate PDFs of your reports and dashboards in the Splunk documentation.

Bug ID: VULN-80075

CWE: CWE-77

CVSSv3.1 Score: 6.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76329: SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the “admin” Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Bug ID: VULN-81931

CWE: CWE-943

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76330: SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build forwarder dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Bug ID: VULN-81990

CWE: CWE-20

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76331: SPL Injection through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions in the Splunk documentation.

Bug ID: VULN-81943

CWE: CWE-943

CVSSv3.1 Score: 8.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVE-2026-76332: SPL Injection through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Analytics Workspace does not sufficiently validate data used to build searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Bug ID: VULN-81994

CWE: CWE-20

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76333: Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or actions available through Splunk Web to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before processing them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-82007

CWE: CWE-79

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76334: SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and selects Continue, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will.

Bug ID: VULN-82075

CWE: CWE-352

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76335: Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Enterprise runs attacker-controlled operating-system commands as the user account running Splunk Enterprise. The vulnerability is possible because Splunk Web does not require the edit_manager_xml capability before accepting Splunk Web Manager XML configuration changes.

Bug ID: VULN-82156

CWE: CWE-94

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76336: Improper Access Control through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the “admin” or “power” Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service disruption. The vulnerability does not affect Splunk Enterprise versions below 10.2. The vulnerability is possible because the SPL2 module management REST API does not sufficiently authorize and validate module deletion requests. For more information see Manage SPL2 modules and Module permissions in the Splunk documentation.

Bug ID: VULN-84160

CWE: CWE-862

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

CVE-2026-76337: Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

Bug ID: VULN-83572

CWE: CWE-22

CVSSv3.1 Score: 5.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76338: Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search and authentication.conf in Splunk documentation.

Additional Solution

Set strictPeerNameValidation = true in authentication.conf on every distributed node, then restart Splunk Enterprise.

Bug ID: VULN-80102

CWE: CWE-287

CVSSv3.1 Score: 8.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

Turn off legacy distributed search token fallback by setting strictPeerNameValidation = true in the authentication.conf configuration file if you do not use distributed search peers that omit peername. Restart Splunk Enterprise on every node in the distributed environment after applying the setting. For more information see authentication.conf in the Splunk documentation.

CVE-2026-76339: SPL Injection through the geostats Command in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could inject arbitrary Search Processing Language (SPL) commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search in Splunk Web. The injected SPL could expose all relevant data available to the second user, including stored credentials, and modify lookup files that the second user has permission to change. The vulnerability is possible because the geostats command does not sufficiently validate input before Splunk Enterprise processes it. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the “admin” or “power” Splunk roles should not be able to exploit the vulnerability at will. For more information see geostats in the Splunk documentation.

Bug ID: VULN-81938

CWE: CWE-77

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76340: Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not require authentication or the change_authentication capability for the token-key reload action. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-83294

CWE: CWE-862

CVSSv3.1 Score: 5.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2026-76341: Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store attacker-controlled Search Processing Language (SPL) in a Table Editor dataset and share the dataset. A user who holds the “admin” Splunk role triggers the SPL when that user opens the dataset in the Table Editor. The SPL runs using the permissions of the second user and could expose all relevant data and modify limited data on the search head. The vulnerability is possible because the Table Editor does not apply SPL safeguards for risky commands when it prepares the dataset initial data. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will. For more information see Define initial data for a new table dataset, SPL safeguards for risky commands, and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-80220

CWE: CWE-863

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76342: Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store risky Search Processing Language (SPL) commands in a Table Editor dataset and share the dataset. A user who holds the “admin” Splunk role triggers the commands when that user opens the dataset in the Table Editor. The commands run using the permissions of the second user and could expose all relevant data and modify lookup files. The vulnerability is possible because the Table Editor does not apply SPL safeguards for risky commands to the field-summary search that it runs for the Initial Data step. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands and Define roles on the Splunk platform with capabilities in the Splunk documentation.

Bug ID: VULN-80222

CWE: CWE-863

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76343: Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access in the Splunk documentation.

Bug ID: VULN-80355

CWE: CWE-89

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Mitigations and Workarounds

Turn off the PostgreSQL sidecar service by setting disabled = true in the [postgres] stanza in the server.conf configuration file if you do not use Edge Processor, OpAmp, or Search Processing Language 2 (SPL2) data pipelines. For more information see Sidecar configuration settings in the Splunk documentation. Note: Turning off the PostgreSQL sidecar service breaks these features and can affect dependent sidecar processes.

CVE-2026-76344: Path Traversal through the Search Dispatch REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer (REST) API endpoint and affect system integrity on the host. The vulnerability is possible because Splunk Enterprise does not validate the search identifier before using it to create a dispatch directory. For more information see About configuring role-based user access in the Splunk documentation.

Bug ID: VULN-80562

CWE: CWE-27

CVSSv3.1 Score: 7.7, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CVE-2026-76345: Remote Code Execution (RCE) through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer (REST) API to write files to locations that the user account running Splunk Enterprise can write to, which could allow for remote code execution. Successful exploitation could result in access to all relevant data and could affect the integrity and availability of the Splunk deployment. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the search head cluster member bundle REST API does not enforce the expected authorization boundary and does not validate bundle paths before accepting bundle content. For more information see Using the REST API reference, About configuring role-based user access, and About distributed search in the Splunk documentation.

Bug ID: VULN-81035

CWE: CWE-284

CVSSv3.1 Score: 6.0, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

CVE-2026-76346: Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the “power” Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds the “admin” Splunk role, the script could access all relevant data available through Splunk Web and perform actions with that user’s permissions. The vulnerability is possible because Splunk Web does not limit the permitted dashboard visualization options to safe presentation settings and does not escape tooltip values before rendering them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “power” Splunk role should not be able to exploit the vulnerability at will. For more information see About configuring role-based user access in the Splunk documentation.

Bug ID: VULN-81666

CWE: CWE-79

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76347: Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the “admin” or “power” Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.

Bug ID: VULN-80530

CWE: CWE-918

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Mitigations and Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.9, 3.9.23, and 3.8.70, or higher. If you cannot upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

CVE-2026-76348: Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

Bug ID: VULN-80531

CWE: CWE-862

CVSSv3.1 Score: 3.8, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Mitigations and Workarounds

Remove the list_search_head_clustering capability from Splunk roles if they do not need Search Head Cluster status information. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

CVE-2026-76349: SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language (SPL) commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access all relevant data. The vulnerability does not affect Splunk Enterprise 10.4 versions and above. The vulnerability is possible because Splunk Web substitutes form token values supplied through the Uniform Resource Locator (URL) into SPL searches without neutralizing them. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Token reference in the Splunk documentation.

Bug ID: VULN-81668

CWE: CWE-943

CVSSv3.1 Score: 6.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

CVE-2026-76350: Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf in the Splunk documentation.

Bug ID: VULN-81669

CWE: CWE-269

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-76351: Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the “admin” or “power” Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.

Bug ID: VULN-80533

CWE: CWE-918

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigations and Workarounds

Turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

CVE-2026-76352: Improper Authorization through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. For more information see Define roles on the Splunk platform with capabilities and limits.conf in the Splunk documentation.

Additional Solution

After upgrading, set scripted_lookup_raw_write_enforcement = block in the limits.conf configuration file under [lookup], and then restart Splunk Enterprise.

Bug ID: VULN-80539

CWE: CWE-285

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-76353: Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and disrupt service. The vulnerability is possible because knowledge bundle delta processing does not restrict removal paths to the staging directory and the endpoint does not enforce the expected authorization boundary. For more information see Knowledge bundle replication overview in the Splunk documentation.

Bug ID: VULN-81034

CWE: CWE-24

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVE-2026-76354: Path Traversal through Search Head Clustering in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the “admin” or “power” Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering, Define roles on the Splunk platform with capabilities, and Secure Splunk Enterprise service accounts in the Splunk documentation.

Bug ID: VULN-80076

CWE: CWE-158

CVSSv3.1 Score: 8.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVE-2026-76355: Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see System architecture of the Edge Processor solution in the Splunk documentation.

Bug ID: VULN-77889

CWE: CWE-306

CVSSv3.1 Score: 7.5, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigations and Workarounds

Turn off Edge Processor by setting edge_processor_enabled = false in the server.conf configuration file if you do not use Edge Processor. For more information see Sidecar configuration settings in the Splunk documentation.

Acknowledgments: Gabriel Nitu, Splunk