CVE-2026-76320: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the Event Type Builder does not properly neutralize special elements in queries, enabling an unauthenticated attacker to induce an authenticated user to run arbitrary SPL searches. This is possible due to the Event Type Builder accepting cross-site request inputs and retaining SPL-affecting values when building sample event searches. Exploitation requires social engineering to trick the user into initiating the request. This vulnerability could lead to exposure of relevant data and stored credentials.

An unauthenticated attacker can leverage this vulnerability to cause an authenticated user to execute arbitrary SPL queries, potentially exposing sensitive data and stored credentials within Splunk Enterprise. However, exploitation requires user interaction via phishing, limiting the attacker's ability to exploit the vulnerability at will.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 and later. Users should upgrade to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official vendor patches. No additional mitigation steps are specified in the vendor advisory.