CVE-2026-76331: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk Enterprise

CVE-2026-76331 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises because Splunk Enterprise does not correctly validate time values provided by callers before using them in saved-search dispatch requests. This flaw enables users lacking admin or power roles to inject SPL commands, which could lead to unauthorized access to data and compromise system integrity. The issue is classified under CWE-943 (Improproper Neutralization of Special Elements in Data Query Logic). The CVSS v3.1 score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality and integrity.

An attacker with limited privileges (not holding admin or power roles) can inject SPL into saved-search dispatch requests, potentially gaining unauthorized access to sensitive data and affecting the integrity of the Splunk Enterprise system. This could lead to exposure of confidential information and unauthorized system behavior.

The vulnerability affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to at least these versions where the issue is fixed. Since no explicit patch links or vendor advisory were provided, confirm patch availability and remediation guidance from official Splunk advisories. No cloud service remediation applies as this is not a cloud service. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.