CVE-2026-76327: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise (<10.4.2, <10.2.6, <10.0.9, <9.4.14) and Splunk Secure Gateway (<3.10.9, <3.9.23, <3.8.70), an unauthenticated attacker can craft a URL that, when opened by a user with admin or sc_admin roles, causes arbitrary SPL commands to run with that user's permissions. This is due to improper neutralization of caller-supplied values in dashboard searches, allowing modification of query logic. The attack requires user interaction (phishing) and cannot be exploited at will by unauthenticated users. The vulnerability impacts confidentiality, integrity, and availability of data accessible to the victim user.

An attacker can execute arbitrary SPL commands with the permissions of an admin or sc_admin user if that user opens a malicious URL. This can lead to exposure of sensitive data available to the user, alteration of search results, and modification of lookup data. The attack requires phishing and user interaction, limiting its ease of exploitation. The vulnerability affects confidentiality (high), integrity (low), and availability (low) of data.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 and Splunk Secure Gateway versions 3.10.9, 3.9.23, and 3.8.70. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, users should be cautious of phishing attempts that could trick privileged users into opening crafted URLs. No vendor advisory content contradicts these recommendations.