CVE-2026-76331: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where non-admin and non-power users can inject SPL into saved-search dispatch requests. The root cause is insufficient validation of time parameters supplied by callers, enabling manipulation of query logic. This flaw can result in unauthorized data access and impact system integrity within Splunk Enterprise.

The vulnerability allows unauthorized users with limited privileges to execute injected SPL commands, potentially accessing all relevant data and affecting the integrity of the Splunk Enterprise system. The CVSS 3.1 score is 8.1 (high), indicating a significant risk of confidentiality and integrity compromise without availability impact.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated in the provided data.