CVE-2026-76354: The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=9.4 <9.4.14, >=10.0 <10.0.9, >=10.2 <10.2.6, and >=10.4 <10.4.2, a vulnerability exists due to insufficient neutralization of NUL characters in replicated bundle file names during search head clustering. This allows a user lacking admin or power roles to craft REST API requests that delete or overwrite files writable by the Splunk Enterprise process on non-captain search head cluster members, impacting system integrity and availability. The root cause is that bundle replication does not validate or neutralize NUL bytes before constructing file paths.

An attacker with limited privileges (not holding admin or power roles) can exploit this vulnerability to delete or temporarily overwrite files writable by the Splunk Enterprise process on non-captain search head cluster members. This can lead to disruption of service availability and compromise system integrity within the affected cluster environment.

A fix is available in Splunk Enterprise versions 9.4.14, 10.0.9, 10.2.6, and 10.4.2. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated in the advisory.