CVE-2026-76321: The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. in Splunk Splunk Enterprise

CVE-2026-76321 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from improper escaping of caller-supplied values in Splunk Web when building SPL queries for nearby-event searches. Additionally, embedded report access accepts these requests without proper authorization verification. An unauthenticated attacker could exploit this to inject arbitrary SPL commands, potentially executing unauthorized searches. The issue is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

An unauthenticated attacker can inject arbitrary SPL commands into search requests, leading to unauthorized search execution. This could result in unauthorized data access or manipulation within Splunk Enterprise. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

No explicit patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to Splunk Web interfaces and embedded reports to trusted users only. Monitor vendor communications for updates and apply patches promptly once available.