CVE-2026-76323: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

The vulnerability exists because the Job Details dashboard in affected Splunk Enterprise versions does not properly neutralize a caller-supplied search identifier before embedding it into SPL searches. This improper input validation enables users without elevated roles (admin or power) to inject SPL commands that execute with the privileges of the authenticated user who opens a crafted link. The attack vector requires user interaction (phishing) to open the malicious Job Details dashboard link. The affected versions are prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

An attacker can gain unauthorized access to data accessible by the victim user and potentially affect system integrity within the permissions of that user. The vulnerability does not allow privilege escalation beyond the authenticated user's permissions but can expose sensitive data and disrupt normal operations within those limits. The attack requires user interaction and is limited to users without admin or power roles.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 and later. Users should upgrade to these versions or later to remediate the vulnerability. Until patched, organizations should be cautious of phishing attempts that could trick users into opening crafted Job Details dashboard links. Restricting access to the Job Details dashboard and educating users about phishing risks can help mitigate exploitation.