CVE-2026-76387

Received Received - Intake

SPL Injection in Splunk Enterprise Security

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could inject Search Processing Language (SPL) through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is possible because the Analyst Queue search filter handling does not validate filter field names before the fields are included in SPL searches. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security), Manage analyst workflows using the analyst queue in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.4/mission-control/manage-analyst-workflows-using-the-analyst-queue-in-splunk-enterprise-security), and Overview of Mission Control in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.5/mission-control/overview-of-mission-control-in-splunk-enterprise-security) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76387

EUVD

EUVD-2026-62952

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise_security	to 8.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Enterprise Security versions below 8.6.1. A user with a role containing the mc_investigation_read capability can inject Search Processing Language (SPL) through Analyst Queue search filters. The issue occurs because filter field names are not validated before being included in SPL searches, allowing access to all relevant data and system integrity tied to scheduled searches for that user.

Impact Analysis

An attacker with the right role could exploit this to access sensitive data or manipulate system integrity through unauthorized SPL injection. This could lead to data breaches, unauthorized access to confidential information, or disruption of scheduled security operations.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. It may result in data exposure, lack of audit trails, or failure to protect confidential information, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Splunk Enterprise Security to version 8.6.1 or later to address the SPL injection vulnerability in Analyst Queue search filters.

Hi! I’m here to help you understand CVE-2026-76387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70