CVE-2026-76273: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the collect Search Processing Language (SPL) command does not properly validate the index name parameter before processing it. A user with the run_collect capability can exploit this to insert arbitrary content into system-level messages on the Splunk platform instance. This vulnerability arises from insufficient input validation affecting control or data flow within the program.

The vulnerability allows an attacker with run_collect capability to add attacker-controlled content to system-level messages, potentially misleading administrators or affecting system monitoring. There is no impact on confidentiality or availability reported. The CVSS score is 4.3 (medium), reflecting limited impact primarily on integrity.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation steps are indicated by the vendor advisory.