CVE-2026-76318: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

This vulnerability affects Splunk Enterprise versions <10.4.2, <10.2.6, <10.0.9, and <9.4.14. A user with schedule_search capability can inject malicious scripts into alert trigger condition fields. These scripts execute in the browsers of other users who open the crafted links, potentially exposing data accessible to those users. The root cause is improper neutralization of user-controllable input in the alert threshold value within the generated alert trigger condition markup.

Successful exploitation allows execution of arbitrary scripts in the context of another user's browser session, potentially exposing all data accessible to that user within Splunk Enterprise. The vulnerability requires another user to open a maliciously crafted link, so social engineering or targeted link sharing is necessary. The impact is limited to data confidentiality; integrity and availability are not affected.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability by properly escaping special characters in alert trigger condition markup. Users should upgrade to these versions or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.