This vulnerability arises because Splunk Web does not consistently escape externally influenced input when constructing SPL commands for searches near a selected event. Additionally, embedded report access does not enforce the expected authorization checks, enabling unauthenticated users to inject arbitrary SPL commands. Affected versions include those before 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An unauthenticated attacker can execute arbitrary SPL commands within the affected Splunk Enterprise instances, potentially leading to unauthorized data access, modification, or disruption of service. This compromises the confidentiality, integrity, and availability of the system's search functionality and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Splunk's official advisories for updates and apply patches once available. Until then, restricting access to Splunk Web interfaces and embedded reports to trusted users may reduce exposure.