CVE-2026-76331

Received Received - Intake

SPL Injection in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76331

EUVD

EUVD-2026-62896

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin or non-power user can inject Search Processing Language (SPL) into saved-search dispatch requests. This allows unauthorized access to data and may impact system integrity because Splunk does not validate time values properly before using them in saved-search dispatch.

Detection Guidance

To detect this vulnerability, review Splunk Enterprise logs for unusual saved-search dispatch requests or SPL injection attempts. Check for requests from non-admin users accessing sensitive data. Monitor for unauthorized access patterns in search endpoints.

Impact Analysis

An attacker with limited access could exploit this to access sensitive data they should not see or alter system integrity by manipulating saved searches. This could lead to data breaches or unauthorized modifications within Splunk Enterprise.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Non-compliance risks include legal penalties, fines, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later. Apply patches immediately. Restrict saved-search dispatch permissions to admin and power roles only. Review and audit saved-search configurations for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-76331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70