CVE-2026-76349: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, an unauthenticated attacker can craft a malicious URL that, when opened by an authenticated user, causes arbitrary SPL commands to be executed with that user's permissions. This is due to improper neutralization of form token values substituted into SPL searches by Splunk Web. The vulnerability enables access to all relevant data accessible by the authenticated user. Exploitation requires tricking the user into clicking the crafted link. Versions 10.2.6 and above are not affected.

An attacker can leverage this vulnerability to execute arbitrary SPL commands with the privileges of an authenticated user, potentially accessing sensitive data. The attack requires user interaction (phishing) and cannot be performed by an unauthenticated attacker alone. The confidentiality impact is high, integrity impact is low, and availability impact is low.

Splunk Enterprise versions 10.2.6 and later include a fix for this vulnerability. Users should upgrade to these versions to remediate the issue. Until upgraded, users should be cautious of unsolicited links and phishing attempts that could trigger this vulnerability.