CVE-2026-76321

Received Received - Intake

SPL Injection in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76321

EUVD

EUVD-2026-63128

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise allows an unauthenticated user to inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This happens because Splunk Web does not properly escape user-supplied values when building SPL for nearby-event searches. Additionally, embedded report access accepts these requests without proper authorization checks.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions for exposure. Use Splunk's CLI command 'splunk version' to verify if your version is below 10.4.2, 10.2.6, 10.0.9, or 9.4.14. Monitor Splunk Web logs for unusual SPL injection attempts in nearby-event searches.

Impact Analysis

An attacker could exploit this to execute unauthorized searches, potentially accessing sensitive data or performing actions within the Splunk environment. This could lead to data leaks, unauthorized modifications, or disruption of services if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected Splunk versions may face regulatory penalties or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later) immediately. If immediate upgrade is not possible, restrict network access to Splunk Web interfaces and disable unauthenticated nearby-event searches until patched.

Hi! I’m here to help you understand CVE-2026-76321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70