In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject… (CVE-2026-76339)

CVE-2026-76339 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user without admin or power roles to inject arbitrary Search Processing Language (SPL) commands through the geostats command. The injected SPL executes with the privileges of another authenticated user who initiates the attacker-controlled search in Splunk Web. This can lead to exposure of all data accessible to the second user, including stored credentials, and modification of lookup files that user can change. The root cause is insufficient input validation in the geostats command. Exploitation requires phishing to trick the second user into running the malicious search.

Successful exploitation can lead to unauthorized data exposure, including stored credentials, and unauthorized modification of lookup files within Splunk Enterprise, under the permissions of a compromised authenticated user. The attacker cannot exploit the vulnerability at will and requires phishing to induce the second user to initiate the malicious search. The vulnerability does not allow privilege escalation beyond the second user's permissions.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to one of these versions or later to remediate the vulnerability. Until patched, organizations should be cautious of phishing attempts that could trick users into initiating malicious geostats searches. No other specific mitigations are provided in the advisory.