CVE-2026-76332: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability in Analytics Workspace where input data used to build searches is not sufficiently validated. An unauthenticated attacker can craft a malicious link that, when opened by an authenticated user, causes Splunk to execute attacker-controlled SPL commands with that user's privileges. This allows the attacker to access data and perform actions permitted to the user. Exploitation requires phishing the user to open the crafted link. The vulnerability is due to improper input validation affecting control and data flow within the program.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the permissions of an authenticated user who opens the crafted link. This can lead to unauthorized data access and actions within Splunk Enterprise. The vulnerability requires user interaction and cannot be exploited directly by unauthenticated attackers. The impact on confidentiality and integrity is high, while availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should be cautious of phishing attempts that may deliver crafted links to Analytics Workspace. Restricting user access and educating users about phishing risks can help mitigate exploitation. Monitor vendor communications for patches or official fixes.