CVE-2026-76330: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. in Splunk Splunk Enterprise

CVE-2026-76330 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker can craft a link to the Monitoring Console that, when opened by an authenticated user, causes Splunk Enterprise to execute attacker-controlled SPL commands with that user's permissions. This occurs because the Monitoring Console does not properly validate data used to build forwarder dashboard searches. The vulnerability requires user interaction (phishing) and cannot be exploited without the user opening the crafted link.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the privileges of the authenticated user who opens the malicious link. This can lead to unauthorized data access and actions permitted to that user. The vulnerability has a high severity score (CVSS 7.1) due to the potential for data confidentiality and integrity compromise, although exploitation requires user interaction and high attack complexity.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unsolicited links to the Monitoring Console and avoid opening suspicious links. Monitoring user awareness and phishing defenses may reduce risk.