CVE-2026-76316 is a high-severity vulnerability in Splunk Enterprise affecting versions prior to 10.4.1, 10.2.5, 10.0.9, and 9.4.14. It allows an unauthenticated remote attacker who can access the Splunk management port to inject a malicious SPL pipeline by registering a specially crafted Deployment Server client identifier. This pipeline executes when an administrator opens the Add Data forwarder workflow, enabling access to sensitive data and potentially impacting system integrity and availability. The root cause is the lack of proper sanitization of special characters in client identifiers within dispatched searches. Successful exploitation depends on administrator interaction with the vulnerable workflow after the attacker’s registration.

An unauthenticated attacker with network access to the Splunk management port can inject and execute arbitrary SPL pipelines when an administrator opens the Add Data forwarder workflow. This can lead to unauthorized access to sensitive data, compromise of system integrity, and disruption of availability of the Splunk platform instance. The vulnerability affects confidentiality, integrity, and availability (CIA triad) of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Splunk management port to trusted administrators only. Avoid opening the Add Data forwarder workflow if untrusted client identities may have been registered. Monitor Splunk documentation and vendor advisories for updates and apply patches promptly once released.