CVE-2026-76332 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker can craft a malicious link to Analytics Workspace that, when opened by an authenticated user, causes Splunk Enterprise to execute attacker-controlled SPL commands with the user's privileges. This occurs due to insufficient validation of input data used to construct searches in Analytics Workspace. The attack requires phishing to convince the user to open the crafted link, and the attacker cannot exploit the vulnerability without user interaction.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the permissions of the authenticated user who opens the crafted link. This can lead to unauthorized data access and actions within Splunk Enterprise limited to the user's privileges. The vulnerability requires user interaction and cannot be exploited remotely without tricking a user, limiting its ease of exploitation.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unsolicited links to Analytics Workspace and educate users to avoid opening suspicious links. Monitoring for phishing attempts targeting Splunk users is recommended.