In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary… (CVE-2026-76320)

CVE-2026-76320 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker can leverage cross-site request forgery (CSRF) via the Event Type Builder to cause an authenticated user to execute arbitrary Search Processing Language (SPL) searches. This can lead to exposure of relevant data and stored credentials. The attack requires user interaction through phishing to trigger the malicious request. The vulnerability is classified under CWE-943 (Improproper Control of Generation of Code).

Successful exploitation can lead to unauthorized disclosure of sensitive data and stored credentials by causing an authenticated user to run arbitrary SPL searches. The attacker does not gain direct access but relies on tricking a legitimate user. There is no indication of system availability impact. The vulnerability requires high attack complexity and user interaction.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should be cautious of phishing attempts targeting Splunk users and consider restricting or monitoring Event Type Builder usage. Follow vendor guidance when published.