In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role… (CVE-2026-76329)

CVE-2026-76329 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows an unauthenticated attacker to craft a Monitoring Console link that, when opened by a user with the admin role, causes Splunk to run attacker-controlled SPL commands with that user's privileges. This occurs due to inadequate validation of data used to build dashboard searches in the Monitoring Console. The attacker must phish the admin user to open the link, as exploitation requires user interaction. The SPL injection can lead to exposure of data accessible to the admin user or modification of lookup data.

Successful exploitation can lead to unauthorized disclosure of data accessible to the admin user and limited modification of lookup data. The vulnerability requires user interaction and high attack complexity, limiting exploitability. There is no indication of active exploitation in the wild. The impact on confidentiality is high, integrity impact is low, and availability impact is low.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about opening links from untrusted sources, especially those that lead to the Monitoring Console. Educate admin users to recognize phishing attempts involving crafted links targeting Splunk dashboards.