CVE-2026-76254: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

CVE-2026-76254 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. An unauthenticated attacker can cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines with the same privileges as the user by exploiting improper validation and escaping of dataset names in Dataset Explorer. SPL safeguards for risky commands are not applied to these searches, enabling potential unauthorized access to data and system integrity compromise. Exploitation requires phishing the user to open a crafted link, so the attacker cannot exploit the vulnerability at will without user interaction.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the privileges of the targeted user, potentially leading to unauthorized access to sensitive data, compromise of system integrity, and disruption of system availability. Because the attacker is unauthenticated and relies on phishing, the attack vector involves social engineering. The vulnerability affects confidentiality, integrity, and availability of the affected Splunk Enterprise systems.

The vulnerability is fixed in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. Users should upgrade to these versions or later to remediate the issue. Until patched, users should be cautious of phishing attempts that could trick them into opening crafted links that exploit this vulnerability. No other mitigations are specified in the advisory.