CVE-2026-76277: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the product does not correctly validate usernames that end with a trailing period. Users with the edit_user capability can create such usernames, leading to distinct native Splunk usernames sharing per-user configuration data. This flaw can cause user-management operations to impact the wrong user account or fail due to the shared configuration data. The vulnerability arises from insufficient input validation before the username is used for user directory operations.

The vulnerability can cause confidentiality, integrity, and availability impacts at a low to medium level. Specifically, it can lead to unintended sharing of user configuration data between different accounts, potentially causing user-management actions to affect incorrect accounts or fail. The CVSS score of 4.1 reflects a medium severity with network attack vector, high attack complexity, and requiring privileges with no user interaction.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.