Threats Tagged 'cve-2026-76332'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Analytics Workspace does not sufficiently validate data used to build searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

CVE-2026-76332 is a high-severity vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an authenticated user into opening a crafted link to Analytics Workspace, causing the system to run attacker-controlled Search Processing Language (SPL) commands with the authenticated user's permissions. This occurs due to insufficient validation of data used to build searches in Analytics Workspace. Exploitation requires user interaction via phishing, and the attacker cannot exploit the vulnerability without tricking a user. The vulnerability impacts confidentiality and integrity with limited availability impact. No explicit patch links are provided, and patch status is not confirmed in the input data.