CVE-2026-76311 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability enables an unauthenticated attacker possessing an embedded report token to download the dispatch archive for an embedded report search job. The root cause is that the embedded report authorization flow fails to block dispatch archive download requests before the archive transmission begins. This can lead to exposure of session material, which may allow unauthorized access to all relevant data and affect the integrity of the Splunk platform instance. The issue is documented in Splunk's official reporting manual under additional configuration for embedded reports and embedding scheduled reports.

An unauthenticated attacker with an embedded report token can access sensitive data by downloading the dispatch archive of embedded report search jobs. This compromises confidentiality and integrity of data on the affected Splunk Enterprise instance. The vulnerability has a CVSS v3.1 score of 9.4 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high confidentiality and integrity impact with low availability impact.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to at least these versions to remediate the vulnerability. Since no vendor advisory patch link was provided, verify the patch status and upgrade instructions in official Splunk documentation or support channels. No other mitigation steps are indicated in the provided data.