CVE-2026-76311: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated attacker possessing an embedded report token can exploit improper access restrictions to download the dispatch archive of an embedded report search job. The vulnerability stems from the embedded report authorization flow failing to block dispatch archive download requests before the archive data is sent, exposing session material. This exposure can lead to unauthorized access to all relevant data and impact system integrity on the affected Splunk platform instance.

An unauthenticated attacker with an embedded report token can access sensitive data by downloading dispatch archives, leading to a compromise of confidentiality and integrity of the Splunk Enterprise instance. The vulnerability allows unauthorized data access and potential system integrity impact. The CVSS score of 9.4 indicates a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Refer to the official Splunk documentation on additional configuration for embedded reports and embedding scheduled reports for further guidance. Patch status is confirmed by the provided affected version ranges indicating fixed versions.