Threats Tagged 'cve-2026-76320'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where an unauthenticated attacker can trick an authenticated user into running arbitrary SPL searches via the Event Type Builder. This occurs due to cross-site request input being accepted and retained in the Event Type Builder, potentially exposing sensitive data and stored credentials. Exploitation requires phishing the authenticated user to initiate a malicious request in their browser. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2026-76320 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to cause an authenticated user to execute arbitrary Search Processing Language (SPL) queries via the Event Type Builder. This occurs because the Event Type Builder improperly handles special elements in queries, retaining SPL-affecting values from cross-site request inputs. Exploitation requires phishing the authenticated user to initiate a crafted request in their browser. The vulnerability could expose sensitive data and stored credentials. The CVSS score is 5.9 (medium severity).