Threats Tagged 'cve-2026-76339'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability in the geostats command that allows a non-admin, non-power user to inject arbitrary SPL commands. This injection occurs when the attacker tricks another authenticated user into initiating a crafted geostats search in Splunk Web. The injected commands execute with the permissions of the second user, potentially exposing sensitive data and allowing modification of lookup files accessible to that user. Exploitation requires user interaction via phishing. The vulnerability arises from insufficient input validation in the geostats command.

CVE-2026-76339 is a command injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user without admin or power roles to inject arbitrary SPL commands via the geostats command. The injected commands execute with the permissions of another authenticated user who initiates the attacker-controlled search, potentially exposing sensitive data and allowing modification of lookup files. Exploitation requires phishing the targeted user to initiate the malicious search in their browser. The vulnerability arises from insufficient input validation in the geostats command.