CVE-2026-76387: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise Security

In Splunk Enterprise Security versions >=8.6 and <8.6.1, the Analyst Queue search filter handling does not properly validate filter field names before including them in SPL searches. A user with a role containing the mc_investigation_read capability can exploit this to inject arbitrary SPL commands, potentially accessing all data and system functions available to the scheduled searches executed under their user context. The vulnerability arises from insufficient input validation affecting control and data flow within the program.

Exploitation of this vulnerability can lead to unauthorized data access and compromise of system integrity within the scope of the affected user's scheduled searches. The attacker can leverage SPL injection to manipulate search queries, potentially exposing sensitive information or altering system behavior. The CVSS 3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact.

Upgrade Splunk Enterprise Security to version 8.6.1 or later, where this vulnerability is fixed. Since the vulnerability is due to improper input validation, applying the official patch eliminates the risk. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version range affected and fixed version 8.6.1.