CVE-2026-76310 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker possessing an embedded report token can exploit the lack of access control on REST API dispatch archive download requests to retrieve the search job dispatch archive. This archive contains session material that can be used to access all data accessible to the report owner, including performing administrative actions if the owner has the admin role. The vulnerability stems from embedded report access not restricting REST API dispatch archive downloads, violating proper access controls.

An attacker can gain unauthorized access to sensitive data and potentially perform administrative actions on the Splunk Enterprise system by exploiting this vulnerability. This compromises confidentiality, integrity, and partially availability (low impact on availability). The impact is critical due to the potential for full data exposure and administrative control without authentication.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict access to embedded report tokens and review embedded report configurations to limit exposure. Refer to Splunk documentation on additional configuration for embedded reports and role-based user access for guidance.