CVE-2026-76330: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the Monitoring Console component does not properly validate input data used to construct forwarder dashboard searches. An unauthenticated attacker can craft a malicious link that, when opened by an authenticated user, causes Splunk Enterprise to execute attacker-controlled SPL commands with the user's privileges. This can lead to unauthorized data access and actions permitted to the user. The vulnerability requires the attacker to phish the user to open the crafted link, as direct exploitation without user interaction is not possible.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the permissions of the authenticated user who opens the malicious link. This can lead to unauthorized access to data and actions within Splunk Enterprise, potentially compromising confidentiality and integrity. The attack requires user interaction (phishing), limiting the attacker's ability to exploit the vulnerability at will.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 and later. Users should upgrade to these versions or later to remediate the vulnerability. Until patched, users should be cautious of unsolicited links to the Monitoring Console and avoid opening suspicious links to reduce the risk of phishing-based exploitation.