CVE-2026-76321
Splunk Splunk
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 7.3 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- Weakness
- CWE-77
- Assigned by
- psirt@cisco.com
Dates
- Published
- 2026-08-19
- Last modified
- 2026-08-27
- Sources
- NVD
Affected products
- Splunk Splunk9.4.0 - 9.4.14, 10.0.0 - 10.0.9, 10.2.0 - 10.2.6, 10.4.0 - 10.4.2
As listed in the NVD configuration data. Not a statement about your estate.