In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary… (CVE-2026-76349)

CVE-2026-76349 affects Splunk Enterprise versions prior to 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker can craft a malicious Splunk Web URL that, when clicked by an authenticated user, causes arbitrary SPL commands to run with that user's permissions. This is due to insufficient neutralization of form token values passed via the URL into SPL searches. The vulnerability requires user interaction (phishing) and does not allow direct exploitation without an authenticated user. Splunk Enterprise 10.4 and later versions are not affected.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the privileges of the authenticated user, potentially accessing all relevant data accessible to that user. The vulnerability requires user interaction and has a CVSS 3.1 base score of 6.4 (medium severity), indicating moderate impact on confidentiality, low impact on integrity, and low impact on availability.

No official patch or fix information is provided in the source data. Since the vulnerability is fixed in Splunk Enterprise 10.4 and later, upgrading to version 10.4 or above is recommended. Until then, users should be cautious of phishing attempts involving crafted Splunk Web links. Monitor vendor advisories for official patches or updates.