CVE-2026-76339: The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the geostats command does not properly neutralize special elements in externally-influenced input, enabling a user lacking admin or power roles to inject arbitrary Search Processing Language (SPL) commands. These injected commands execute with the permissions of a second authenticated user who is tricked into running the attacker-controlled search, potentially exposing all data accessible to that user, including stored credentials, and allowing modification of lookup files. The attack requires user interaction via phishing to initiate the malicious search. This vulnerability is due to insufficient input validation in the geostats command prior to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

An attacker with limited Splunk roles can inject arbitrary SPL commands that execute with the permissions of another authenticated user who initiates the search. This can lead to exposure of sensitive data accessible to that user, including stored credentials, and unauthorized modification of lookup files. The vulnerability requires phishing to trick the victim into initiating the malicious search, limiting exploitation to scenarios involving user interaction.

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, where this vulnerability is fixed. Users without admin or power roles should be aware that exploitation requires phishing to induce them to initiate a malicious search. No other mitigations are explicitly stated. Patch status is confirmed fixed in the stated versions.