CVE-2026-76316 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.1, 10.2.5, 10.0.9, and 9.4.14. It allows an unauthenticated user with access to the Splunk management port to inject malicious Search Processing Language (SPL) pipelines. This occurs because Deployment Server client identifiers are improperly sanitized, enabling SPL injection when an administrator opens the Add Data forwarder workflow. Exploitation can lead to unauthorized data access, system integrity compromise, and availability impact.
CVE-2026-76315 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to execute arbitrary code via Splunk Web Manager Configuration due to improper input neutralization and insufficient permission checks on the REST API path for manager configuration. This can lead to unauthorized data access and compromise of system integrity and availability.
CVE-2026-76314 is a high-severity vulnerability in Splunk Enterprise that allows a user without admin or power roles to perform remote code execution by submitting crafted Splunk Web Manager Configuration content. This occurs in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 due to insufficient input validation of Extensible Markup Language expressions and improper access control on configuration routes.
CVE-2026-76313 is a high-severity vulnerability in Splunk Enterprise that allows users without admin or power roles to perform remote code execution by uploading malicious knowledge bundles. This occurs because the REST API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts knowledge bundles from unauthorized users. The vulnerability affects multiple versions of Splunk Enterprise prior to specific fixed releases.
CVE-2026-76312 is a critical vulnerability in Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated user who can read the HTML source of a page embedding a Splunk report to access sensitive session material. This exposure enables unauthorized access to all relevant data and can impact system integrity. The root cause is improper enforcement of authorization boundaries in the dispatch archive download path, which includes sensitive session data in archived search-job data.
CVE-2026-76311 is a critical vulnerability in Splunk Enterprise that allows an unauthenticated user with an embedded report token to download the dispatch archive of an embedded report search job. This can expose session material and enable unauthorized access to relevant data, compromising system integrity. The issue arises because the embedded report authorization flow does not properly block dispatch archive download requests before data transmission begins. Versions affected include those prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
CVE-2026-76310 is a critical vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated user with an embedded report token to download the associated search job dispatch archive and recover session material. This enables access to all data available to the report owner and can affect system integrity, including performing administrative actions if the owner has the admin role. The issue arises because embedded report access does not block REST API dispatch archive download requests.
CVE-2026-76309 is a medium-severity SQL injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows low-privileged users without admin or power roles to inject SQL commands via the REST API due to improper neutralization of user-supplied input in database queries.
CVE-2026-76263 is a medium severity vulnerability in Splunk Enterprise that affects versions 10.2 up to but not including 10.2.6 and versions 10.4 up to but not including 10.4.2. It allows users without admin or power roles to delete SPL2 modules owned by other users due to broken object-level authorization in the data management orchestrator interface. The vulnerability arises because the system does not verify ownership before allowing deletion of these modules.
CVE-2026-76262 is an information disclosure vulnerability in Splunk Enterprise versions 10.4 up to but not including 10.4.2. It allows unauthenticated users to access Prometheus service metrics from the Edge Processor SPL2 Preview sidecar without authentication. This exposure reveals runtime and build metadata of the sidecar. Versions prior to 10.4 are not affected. The vulnerability arises because the Prometheus metrics endpoint lacks authentication, permitting any client able to reach the sidecar to retrieve sensitive metrics data without credentials.
CVE-2026-76261 affects certain versions of Splunk Enterprise and Splunk Secure Gateway. It allows users without admin or power roles to read Spacebridge asymmetric private keys via the Splunk Secure Gateway App Key Value Store REST API if the private-key migration from older deployments is incomplete. This occurs due to insecure default access control lists on key material collections. The vulnerability is rated medium severity with a CVSS score of 5.3.
CVE-2026-76260 is a vulnerability in Splunk Enterprise that allows users with the rest_properties_get capability to read encrypted stored credentials via the REST API. This occurs because the permissions for accessing stored credentials are incorrectly assigned, permitting unintended access. The issue affects multiple versions of Splunk Enterprise prior to specific fixed releases. Exploitation can expose sensitive data protected by these stored credentials.
In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.