CVE-2026-76273

Received Received - Intake

Splunk Enterprise Index Name Validation Bypass

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76273

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A user with a role that has the run_collect capability can exploit the collect SPL command to inject attacker-controlled content into system-level messages by not validating the index name before processing.

Detection Guidance

To detect this vulnerability, check Splunk Enterprise versions for those below 10.4.3, 10.2.7, 10.0.10, or 9.4.15. Review logs for unauthorized use of the collect SPL command with attacker-controlled index names. Look for system-level message modifications.

Impact Analysis

An attacker could manipulate system messages, potentially leading to misinformation, confusion, or unauthorized actions within the Splunk platform. This could affect monitoring, auditing, and operational integrity.

Compliance Impact

This vulnerability may compromise data integrity and audit logs, which are critical for compliance with GDPR, HIPAA, and other regulations. Unauthorized changes to system messages could lead to non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) to address the vulnerability. Remove or restrict the run_collect capability from roles that do not require it.

Hi! I’m here to help you understand CVE-2026-76273. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70