CVE-2026-76321: The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, an unauthenticated attacker can inject arbitrary SPL commands into requests that search for events near a selected event. This occurs because Splunk Web does not consistently escape externally supplied input when constructing SPL queries for nearby-event searches, and embedded report access does not enforce the expected authorization checks. This vulnerability enables unauthorized search execution, potentially leading to information disclosure and impact on system integrity and availability.

The vulnerability allows unauthenticated attackers to execute arbitrary SPL queries, which can lead to unauthorized access to search results, potential data leakage, and disruption of service. The CVSS 3.1 score of 7.3 reflects high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these versions or later to remediate the issue. No alternative mitigations or workarounds are specified in the provided data.