CVE-2026-76316: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

This vulnerability arises from improper neutralization of special characters in Deployment Server client identifiers used in dispatched searches within Splunk Enterprise. An unauthenticated attacker who can reach the management port can register a crafted Deployment Server client identity containing malicious SPL code. When an administrator subsequently opens the Add Data forwarder workflow, the injected SPL pipeline executes, potentially accessing sensitive data and affecting system integrity and availability. The issue affects versions prior to 10.4.1, 10.2.5, 10.0.9, and 9.4.14.

Successful exploitation allows an unauthenticated attacker to execute arbitrary SPL code in the context of an administrator opening the Add Data forwarder workflow. This can lead to unauthorized access to all relevant data, compromise of system integrity, and disruption of the Splunk platform's availability. The vulnerability requires the attacker to have network access to the Splunk management port and relies on administrator interaction.

Splunk has released fixed versions 10.4.1, 10.2.5, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these versions or later to remediate the issue. Until upgrading, restrict network access to the Splunk management port to trusted administrators only and avoid opening the Add Data forwarder workflow if possible. Review Splunk's official documentation on forward data and agent management for additional guidance.