CVE-2026-76330 is a vulnerability in Splunk Enterprise that affects versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an authenticated user into opening a malicious Monitoring Console link, causing the system to execute attacker-controlled Search Processing Language (SPL) commands with the authenticated user's permissions. This occurs due to insufficient validation of data used in forwarder dashboard searches. Exploitation requires user interaction via phishing and cannot be performed directly by the attacker without user involvement.
CVE-2026-76329 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an admin user into opening a crafted Monitoring Console link that executes attacker-controlled Search Processing Language (SPL) commands with the admin's permissions. This can lead to exposure of data accessible to the admin or modification of lookup data. Exploitation requires phishing the admin user to open the malicious link. The vulnerability arises from insufficient validation of data used in dashboard searches within the Monitoring Console.
CVE-2026-76328 affects Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" Splunk role to store malicious Search Processing Language (SPL) code in a dashboard. When another authenticated user exports this dashboard as a PDF, the injected SPL executes with the exporting user's permissions, potentially accessing or modifying their data. The vulnerability arises from insufficient validation of dashboard content during PDF export. Exploitation requires phishing the affected user to trigger the export action. The vulnerability has a CVSS score of 6.7, indicating medium severity.
CVE-2026-76327 is a vulnerability in Splunk Enterprise and Splunk Secure Gateway versions prior to specified fixed releases. It allows an unauthenticated attacker to trick an admin or sc_admin user into opening a crafted URL that executes arbitrary Search Processing Language (SPL) commands with the victim's permissions. This occurs because dashboard searches do not properly neutralize user-supplied input, enabling modification of query logic. Exploitation requires phishing the targeted user to initiate the request in their browser. The vulnerability can expose data accessible to the user and affect search results or lookup data.
CVE-2026-76326 is a vulnerability in Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to store dashboard views that execute JavaScript in other users' browsers when they hover over sparkline table cells. This occurs because the dashboard table renderer does not properly escape or restrict tooltip content, potentially exposing data accessible to the affected user.
CVE-2026-76325 is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" role can store a malicious UI-tour knowledge object that executes arbitrary JavaScript in the browser of other authenticated users visiting standard Splunk Web pages. This vulnerability arises because Splunk Web uses untrusted tour content from the app namespace without proper neutralization. Exploitation can expose sensitive data and affect system integrity within the permissions of the affected user.
CVE-2026-76324 is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" Splunk role can create a malicious Splunk Web tour that executes arbitrary JavaScript in another user's browser when they open a crafted tour link. This occurs because Splunk Web does not properly encode tour content and navigation links, allowing injection of markup. Exploitation requires user interaction by opening the crafted link. The vulnerability impacts confidentiality by allowing access to data available to the affected user. The CVSS score is 5.7, indicating medium severity.
CVE-2026-76323 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows non-admin and non-power users to bypass Search Processing Language (SPL) safeguards via the Job Details dashboard by injecting crafted SPL commands. Exploitation requires tricking an authenticated user into opening a malicious Job Details dashboard link, which then executes SPL with that user's permissions. This can lead to unauthorized access to data and impact system integrity within the scope of the user's permissions.
CVE-2026-76322 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "user" role to craft a Dashboard Studio dashboard that executes attacker-controlled Search Processing Language (SPL) queries on behalf of another authenticated user. This occurs because Dashboard Studio does not consistently enforce app-visibility authorization boundaries before dispatching search queries. Exploitation requires phishing the targeted user to initiate a request in their browser. The vulnerability impacts confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 6.7, indicating medium severity.
CVE-2026-76321 is a command injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows unauthenticated users to inject arbitrary Search Processing Language (SPL) into nearby-event search requests due to improper escaping of user-supplied input and missing authorization checks in embedded report access.
CVE-2026-76320 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to cause an authenticated user to execute arbitrary Search Processing Language (SPL) queries via the Event Type Builder. This occurs because the Event Type Builder improperly handles special elements in queries, retaining SPL-affecting values from cross-site request inputs. Exploitation requires phishing the authenticated user to initiate a crafted request in their browser. The vulnerability could expose sensitive data and stored credentials. The CVSS score is 5.9 (medium severity).
CVE-2026-76319 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a low-privileged user without the fsh_manage capability to perform remote code execution via Federated Search bundle selection. This occurs because the system does not enforce authorization checks on the caller-controlled bundle selection in the Federated Search dispatch flow. Exploitation could lead to unauthorized access to data and compromise system integrity and availability.
CVE-2026-76318 is a cross-site scripting (XSS) vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the schedule_search capability to store malicious scripts in alert trigger condition fields. When another user opens a crafted link containing this script, it executes in their browser and can access data available to that user. The issue arises because Splunk Web does not properly escape special characters in alert threshold values used in alert trigger condition markup.
CVE-2026-76317 is a path traversal vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows non-admin and non-power users to move files readable by the Splunk Enterprise service into a lookup controlled by the user, potentially exposing sensitive data and impacting system integrity and availability on the search head.