CVE-2026-76339

Received Received - Intake

Splunk Enterprise SPL Injection via Geostats Command

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language (SPL) commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search in Splunk Web. The injected SPL could expose all relevant data available to the second user, including stored credentials, and modify lookup files that the second user has permission to change. The vulnerability is possible because the geostats command does not sufficiently validate input before Splunk Enterprise processes it. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see geostats (https://help.splunk.com/en/splunk-enterprise/spl-search-reference/10.0/search-commands/geostats) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76339

EUVD

EUVD-2026-62904

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin or non-power user can inject arbitrary Search Processing Language (SPL) commands via the geostats command. When another authenticated user runs the attacker-controlled search in Splunk Web, the injected SPL executes with that user's permissions. This could expose sensitive data like stored credentials or allow modifications to lookup files the second user can access.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions for affected releases (below 10.4.2, 10.2.6, 10.0.9, or 9.4.14). Inspect Splunk logs for unusual geostats command usage or unauthorized SPL injection attempts. Monitor user roles and permissions to ensure no non-admin or non-power users are executing sensitive SPL commands.

Impact Analysis

An attacker could trick a user into initiating a malicious search, leading to unauthorized data exposure or file modifications. The attacker gains access to data the victim can view and may alter files the victim has permission to change. However, the attacker must first phish the victim to trigger the exploit.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR or HIPAA requirements for data protection and integrity. Organizations using affected Splunk versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade Splunk Enterprise to the latest patched versions (10.4.2, 10.2.6, 10.0.9, or 9.4.14). Restrict geostats command access to admin and power roles only. Review and audit user permissions to ensure least privilege. Monitor Splunk Web activity for suspicious search requests.

Hi! I’m here to help you understand CVE-2026-76339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70