In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search… (CVE-2026-76336)

CVE-2026-76336 affects Splunk Enterprise versions prior to 10.4.2 and 10.2.6. It allows a user lacking admin or power roles to delete all Search Processing Language 2 (SPL2) modules across all applications and users on the instance by exploiting insufficient authorization in the SPL2 module management REST API. This vulnerability can result in the deletion of exported datasets and functions, thereby affecting system integrity and causing partial disruption of service. Versions below 10.2 are not affected. The root cause is inadequate authorization and validation of deletion requests in the SPL2 module management API.

The vulnerability enables unauthorized users with limited privileges to delete critical SPL2 modules, which can remove exported datasets and functions. This compromises system integrity and may cause partial service disruption within the affected Splunk Enterprise instance. There is no impact on confidentiality, but integrity and availability are affected to a high and low degree respectively.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SPL2 module management REST API to trusted users only, and monitor for unusual deletion activity. Users should upgrade to Splunk Enterprise versions 10.4.2 or 10.2.6 or later once patches are released.