CVE-2026-76342

Received Received - Intake

Stored Command Injection in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language (SPL) commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user opens the dataset in the Table Editor. The commands run using the permissions of the second user and could expose all relevant data and modify lookup files. The vulnerability is possible because the Table Editor does not apply SPL safeguards for risky commands to the field-summary search that it runs for the Initial Data step. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76342

EUVD

EUVD-2026-62907

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can store risky SPL commands in a Table Editor dataset and share it. When an 'admin' user opens this dataset, the commands execute using the admin's permissions, potentially exposing or modifying sensitive data. The issue occurs because the Table Editor does not apply SPL safeguards to the field-summary search.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions for affected releases and monitoring for suspicious dataset sharing or SPL command execution. Review Splunk logs for unauthorized dataset access or field-summary searches initiated by non-admin users. Check for datasets created by users with the 'power' role that are shared with 'admin' users.

Impact Analysis

An attacker could trick a user with the 'power' role into sharing a malicious dataset. When an admin opens it, risky commands run with admin privileges, exposing all relevant data or modifying lookup files. This requires social engineering to initiate a browser request.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later. Restrict the 'power' role to prevent dataset sharing. Disable risky SPL commands in Table Editor by applying SPL safeguards. Monitor for phishing attempts targeting admin users to open shared datasets.

Hi! I’m here to help you understand CVE-2026-76342. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70