CVE-2026-76254: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, Dataset Explorer does not neutralize special elements in dataset names before constructing SPL queries, nor does it enforce SPL safeguards on these queries. This flaw enables an unauthenticated attacker to trick a user into executing arbitrary SPL pipelines with the user's privileges, potentially exposing all data and system functions accessible to that user. The attack vector requires user interaction via phishing. The vulnerability is tracked as CVE-2026-76254 with a CVSS 3.1 score of 7.5 (High).

An unauthenticated attacker can leverage this vulnerability to cause a victim user to execute arbitrary SPL commands with that user's privileges, potentially leading to unauthorized access to sensitive data, modification of data, and disruption of system availability. The attack requires phishing to trick the user into opening a malicious link, so it is not exploitable without user interaction.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14 that address this vulnerability. Users should upgrade to these versions or later. Until patched, users should be cautious of phishing attempts involving crafted links targeting Dataset Explorer. Refer to Splunk documentation on managing datasets and SPL safeguards for risky commands for additional security best practices.