CVE-2026-76323

Received Received - Intake

Splunk Enterprise SPL Command Injection via Job Details Dashboard

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language (SPL) safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity within those permissions. The vulnerability is possible because the Job Details dashboard does not correctly neutralize a caller-supplied search identifier before placing it into SPL searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see About jobs and job management (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/manage-jobs/about-jobs-and-job-management) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76323

EUVD

EUVD-2026-63130

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin user could bypass SPL safeguards via the Job Details dashboard by injecting malicious SPL commands. The injected SPL runs using permissions of an authenticated user who opens a crafted link, potentially accessing data and affecting system integrity within those permissions.

Detection Guidance

Detection involves monitoring for unusual SPL commands executed via the Job Details dashboard. Check Splunk logs for suspicious search identifiers or commands not initiated by admin or power users. Review access logs for unexpected dashboard link interactions.

Impact Analysis

An attacker could trick a user into opening a malicious link, allowing them to execute SPL commands with the user's permissions. This could lead to unauthorized data access or modifications, depending on the user's access level. The impact is limited to the permissions of the tricked user.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive information. Compliance may be affected if unauthorized access occurs, depending on the data involved.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later. Restrict access to the Job Details dashboard for non-admin and non-power users. Monitor for phishing attempts targeting users with Splunk access.

Hi! I’m here to help you understand CVE-2026-76323. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70