CVE-2026-76322

Received Received - Intake

Splunk Enterprise Dashboard Studio SPL Injection

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "user" Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/dashboard-studio/10.4/use-data-sources/create-search-based-visualizations-with-ds.search) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76322

EUVD

EUVD-2026-63129

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	9.4.14
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	10.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'user' role can create a malicious Dashboard Studio dashboard that executes attacker-controlled SPL for another authenticated user. The SPL can access all data and impact system integrity and availability due to improper enforcement of app-visibility authorization boundaries before search queries are processed.

Impact Analysis

An attacker could trick a user into initiating a request in their browser, leading to unauthorized data access, system integrity compromise, or reduced system availability. The impact depends on the data processed by Splunk and the privileges of the affected user.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing sensitive data. Compliance risks include data breaches, unauthorized access, and failure to maintain data integrity and confidentiality.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later) to address the vulnerability. Restrict the 'user' role permissions and monitor for suspicious dashboard activities.

Hi! I’m here to help you understand CVE-2026-76322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70