CVE-2026-76344 is a path traversal vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to write dispatch metadata to arbitrary locations on the host by supplying a crafted search identifier to a REST API endpoint. This occurs because the software does not properly sanitize multiple internal '../' sequences in the search identifier, enabling directory traversal outside the intended restricted directory.
CVE-2026-76343 is a SQL injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to execute arbitrary SQL queries via the Data Orchestration jobs endpoint. This occurs because user-controlled job filter values are used to build database queries without proper parameterization. Exploitation can lead to unauthorized access to nearly all data managed by Data Orchestration, including other users' jobs and stored credentials.
CVE-2026-76342 is a medium severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It involves improper authorization checks allowing a user with the "power" role to embed risky SPL commands in a Table Editor dataset. When an "admin" user opens this dataset, these commands execute with the admin's permissions, potentially exposing sensitive data and modifying lookup files. Exploitation requires phishing the admin user to trigger the commands in their browser. The issue arises because the Table Editor does not apply SPL safeguards to certain searches during the Initial Data step.
CVE-2026-76341 is a medium severity vulnerability in Splunk Enterprise that affects versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" role to store malicious Search Processing Language (SPL) in a Table Editor dataset, which is then executed with the permissions of an "admin" user who opens the dataset. This can lead to unauthorized data exposure and limited data modification on the search head. Exploitation requires phishing the admin user to trigger the SPL execution within their browser. The vulnerability arises because the Table Editor does not apply SPL safeguards for risky commands when preparing initial dataset data.
CVE-2026-76340 is a medium severity vulnerability in Splunk Enterprise versions 10.4 up to but not including 10.4.2. It allows an unauthenticated user to reload token-signing keys via the REST API because the API does not require authentication or the necessary capability for this action. Versions prior to 10.4 are not affected.
CVE-2026-76339 is a command injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user without admin or power roles to inject arbitrary SPL commands via the geostats command. The injected commands execute with the permissions of another authenticated user who initiates the attacker-controlled search, potentially exposing sensitive data and allowing modification of lookup files. Exploitation requires phishing the targeted user to initiate the malicious search in their browser. The vulnerability arises from insufficient input validation in the geostats command.
CVE-2026-76338 is a high-severity vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker with access to a trusted distributed search private key to forge an administrative session token. This flaw arises because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, falling back to shared local key material. Exploitation can lead to unauthorized data access, system integrity compromise, and service disruption.
CVE-2026-76337 is a medium severity vulnerability in Splunk Enterprise that allows an unauthenticated user to read JavaScript files outside the intended Splunk Web static directory. This occurs because the software does not properly sanitize pathname inputs, enabling directory traversal beyond the restricted directory. The issue affects multiple versions of Splunk Enterprise prior to fixed releases.
CVE-2026-76336 is a high-severity vulnerability in Splunk Enterprise versions 10.2 up to but not including 10.2.6, and 10.4 up to but not including 10.4.2. It allows users without admin or power roles to delete all SPL2 modules across all apps and users via the SPL2 module management REST API due to insufficient authorization checks. This can lead to deletion of exported datasets and functions, impacting system integrity and causing partial service disruption.
CVE-2026-76335 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an authenticated user without the edit_manager_xml capability to write malicious Splunk Web Manager XML configurations. When such a user accesses the affected Splunk Web Manager page, the system executes attacker-controlled operating system commands with the privileges of the Splunk Enterprise user account. This occurs because Splunk Web does not enforce the edit_manager_xml capability before accepting configuration changes, leading to improper neutralization of input that modifies code behavior.
CVE-2026-76334 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" role to store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user triggers this action, the injected SPL executes with their permissions, potentially accessing or modifying their data. The vulnerability arises from insufficient validation of workflow-action URLs in Dashboard Studio and requires phishing to trick the victim into initiating the request.
CVE-2026-76333 is a cross-site scripting (XSS) vulnerability in Splunk Enterprise Dashboard Studio affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" Splunk role can store a crafted URL in a workflow action that executes attacker-controlled JavaScript in the browser of another authenticated user when selected. This could expose sensitive data or allow unauthorized actions via Splunk Web. Exploitation requires phishing to trick the victim into triggering the malicious action. The vulnerability arises from insufficient validation of workflow-action URLs. The affected user role limits the attacker's ability to exploit this at will.
CVE-2026-76332 is a high-severity vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an authenticated user into opening a crafted link to Analytics Workspace, causing the system to run attacker-controlled Search Processing Language (SPL) commands with the authenticated user's permissions. This occurs due to insufficient validation of data used to build searches in Analytics Workspace. Exploitation requires user interaction via phishing, and the attacker cannot exploit the vulnerability without tricking a user. The vulnerability impacts confidentiality and integrity with limited availability impact. No explicit patch links are provided, and patch status is not confirmed in the input data.
CVE-2026-76331 is a high-severity vulnerability in Splunk Enterprise that affects versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to inject Search Processing Language (SPL) into saved-search dispatch requests due to improper validation of caller-supplied time values. This can lead to unauthorized access to data and compromise system integrity.
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build forwarder dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.