CVE-2026-76328: The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. in Splunk Splunk Enterprise

CVE-2026-76328 affects Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" role can store attacker-controlled SPL in a dashboard. When another authenticated user exports this dashboard as a PDF, Splunk executes the injected SPL with the exporting user's permissions. This occurs because Splunk Web does not adequately validate dashboard content before processing PDF exports. The attack requires social engineering to induce the victim to export the dashboard, enabling the injected SPL to access or modify data available to that user.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the permissions of an authenticated user who exports the malicious dashboard as a PDF. This can lead to unauthorized access or modification of data accessible to that user. The attacker cannot exploit this vulnerability at will and must rely on phishing to trick the victim into exporting the dashboard. The vulnerability has a CVSS score of 6.7 (medium severity), indicating a moderate risk with high impact on confidentiality and integrity, but requiring user interaction and low privileges.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the "power" role to trusted users only and educate users about phishing risks. Monitor Splunk documentation and advisories for updates regarding patches or official mitigations.