CVE-2026-76329: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

In affected Splunk Enterprise versions, the Monitoring Console does not properly validate input used to construct dashboard searches. An unauthenticated attacker can craft a malicious link that, when opened by a user with the admin role, causes Splunk Enterprise to execute attacker-controlled SPL commands with that user's privileges. This can result in unauthorized data exposure or modification of lookup data. Exploitation requires user interaction via phishing and cannot be performed at will by the attacker.

Successful exploitation can lead to unauthorized disclosure of data accessible to the admin user and limited modification of lookup data. The attacker does not gain direct access but leverages the admin user's permissions through social engineering. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. The CVSS score is 6.4 (medium severity), reflecting the need for user interaction and high attack complexity.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 and later. Users should upgrade to these versions to remediate the vulnerability. Until patched, organizations should educate admin users to be cautious of unsolicited links to the Monitoring Console and avoid opening suspicious URLs. No other vendor advisory content is provided; therefore, patching is the primary mitigation.