In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an… (CVE-2026-76327)

In affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) and Splunk Secure Gateway (below 3.10.9, 3.9.23, and 3.8.70), an unauthenticated attacker can craft a URL that, when opened by a user with admin or sc_admin roles, causes arbitrary SPL commands to execute within dashboard searches. This occurs because the dashboards do not properly sanitize caller-supplied input before using it in searches. The attacker must phish the victim to open the malicious URL, as direct exploitation without user interaction is not possible. The vulnerability can lead to exposure of all data accessible to the victim and manipulation of search results or lookup data.

An attacker can expose sensitive data available to the targeted user and manipulate search results or lookup data by executing arbitrary SPL commands with the victim's permissions. The attack requires user interaction via phishing and cannot be performed by an unauthenticated attacker at will. The confidentiality impact is high, integrity impact is low, and availability impact is low according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should be cautious of phishing attempts that may trick privileged users into opening crafted URLs. No official fix or temporary workaround is provided in the available data.