CVE-2026-76320

Received Received - Intake

Unauthenticated SPL Search Execution in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language (SPL) searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability is possible when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Automatically find and build event types (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.0/event-types/automatically-find-and-build-event-types) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76320

EUVD

EUVD-2026-63127

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker can trick an authenticated user into running arbitrary SPL searches via the Event Type Builder. This could expose data and stored credentials. The attack requires phishing the user to initiate a request in their browser.

Detection Guidance

Detecting this vulnerability requires checking the Splunk Enterprise version installed. Run 'splunk version' in the command line to verify if your version is below 10.4.2, 10.2.6, 10.0.9, or 9.4.14. If so, the system is vulnerable.

Impact Analysis

An attacker could gain access to sensitive data or credentials by tricking a user into running malicious SPL searches. This may lead to data breaches, unauthorized access, or further exploitation within the Splunk environment.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements such as GDPR or HIPAA. Organizations may face penalties or legal consequences if sensitive data is compromised due to this flaw.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2 or later, 10.2.6 or later, 10.0.9 or later, or 9.4.14 or later) immediately. Avoid using the Event Type Builder feature until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-76320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70