CVE-2026-76323 SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

CVE-2026-76322 SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76321 SPL Injection through Nearby Event Searches in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language SPL into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible becau...

CVE-2026-76322 SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76321 SPL Injection through Nearby Event Searches in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language SPL into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible becau...

CVE-2026-76322

CVE-2026-76322 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 ) affecting the Dashboard Studio component. A user holding the "user" role can craft a dashboard that executes attacker-controlled Search Processing Language (SPL) in the conte...

CVE-2026-76321

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, Splunk Web fails to escape caller-supplied values when building SPL for nearby-event searches, and embedded report access accepts those requests without authorization checks, allowing unauthenticated users to inject arbitrary...

CVE-2026-76320

CVE-2026-76320 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Type Builder of Splunk Web (Splunk Enterprise). The Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches, allowing an unauthenticated attacker to c...

CVE-2026-76320 SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

CVE-2026-76320 SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

CVE-2026-76316 Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

CVE-2026-76316

An unauthenticated remote attacker who can reach the Splunk management port can register a crafted Deployment Server client identifier, which is then inserted into dispatched searches without special-character sanitization. When an administrator opens the Add Data forwarder workflow, the injected...

CVE-2026-76316 Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76254

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14 are affected. Dataset Explorer fails to validate or escape dataset names when building SPL searches and skips SPL safeguards for risky commands, enabling a phishing attack to execute arbitrary SPL under the victim's privi...

CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

CVE-2026-76253

Any user with the schedule_search capability can execute arbitrary SPL commands at system level, reading all stored credentials. Splunk advisory SVD-2026-0801 documents fixes in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation details are not provided in the documents.

CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...