CVE-2026-76367 Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-76361

Splunk SOAR versions below 8.6.0 are affected by an SSRF vulnerability in the /rest/support/connectivity/.../check_connectivity REST API endpoint, which fails to validate destination hosts before initiating outbound connections, allowing an Administrator-role user to probe internal network reacha...

CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-76359 Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

CVE-2026-76359

CVE-2026-76359 is a path traversal vulnerability in Splunk SOAR (On-premises) versions below 8.6.0 . The Universal Forwarder installer's credentials-package extraction workflow does not verify that each archive member remains within the intended destination directory before extraction. A user wit...

CVE-2026-76357

In Splunk SOAR on-premises versions below 8.6.0, the REST API fails to enforce role requirements and does not confine user-supplied file paths to the temporary directory, enabling an authenticated, role-less user to submit crafted paths and achieve arbitrary code execution (CVSS 7.6, HIGH). No in...

CVE-2026-76346

CVE-2026-76346 is a stored XSS in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) caused by Splunk Web failing to escape tooltip values in dashboard sparkline format options. A user with the "power" role can inject a malicious script that executes in the browser of another u...

CVE-2026-76346 Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76344 Path Traversal through the Search Dispatch REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76342 Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76341 Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76333 Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

CVE-2026-76333

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient URL validation in Dashboard Studio workflow actions. A user holding the "power" role can store a crafted URL in a workflow ac...

CVE-2026-76331 SPL Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

CVE-2026-76328

A user with the "power" Splunk role can inject attacker-controlled SPL into a dashboard; when another user exports it to PDF, the injected SPL executes with that victim's permissions. Splunk Web fails to validate dashboard content during PDF export. Affected versions: below 10.4.1, 10.2.6, 10.0.9...

CVE-2026-76327

CVE-2026-76327 is an SPL injection vulnerability in Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (below 3.10.9, 3.9.23, 3.8.70). The root cause is that Secure Gateway dashboards fail to neutralize caller-supplied values before embedding them in dashboard sear...

CVE-2026-76327 SPL Injection through Splunk Web in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...

CVE-2026-76328 SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...

CVE-2026-76325

CVE-2026-76325 is a Stored Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the "power" role can store a malicious ui-tour knowledge object matching an auto-tour page name and share it at the app level. The root cause...