CVE-2026-76340

Splunk Enterprise 10.4.x versions below 10.4.2 are affected by a missing authorization vulnerability in the REST API . The token-key reload endpoint does not require authentication or the change_authentication capability, allowing an unauthenticated attacker to force a reload of token-signing key...

CVE-2026-76339 SPL Injection through the geostats Command in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated use...

CVE-2026-76340 Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer REST API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because...

CVE-2026-76339

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the geostats command fails to validate input, allowing a low-privileged user to inject arbitrary SPL that executes under another user's permissions after phishing. CVSS 5.4 (MEDIUM); no exploitation evidence provided. Upgrade to affec...

CVE-2026-76338 Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

CVE-2026-76337 Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...

CVE-2026-76337

CVE-2026-76337 is a path traversal vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that Splunk Web does not restrict static file requests to the configured static directory, allowing an unauthenticated attacker to read JavaScript ...

CVE-2026-76338

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are vulnerable because the distributed search token REST endpoint does not require a signed request, falling back to shared local key material. An attacker with a trusted distributed search private key can forge an admin session ...

CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76335 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the editmanagerxml capability could write a malicious Splunk Web Manager Extensible Markup Language XML configuration. When the same user opens the affected Splunk Web Manag...

CVE-2026-76334 SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

CVE-2026-76335

CVE-2026-76335 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . An authenticated user without the edit_manager_xml capability can write a malicious Splunk Web Manager XML configuration . When the same user opens the affected page, S...

CVE-2026-76334

CVE-2026-76334 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) affecting the Dashboard Studio component. A user holding the "power" role can store a workflow action containing attacker-controlled SPL. When another authenticated user selec...

CVE-2026-76332 SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

CVE-2026-76332

Affected: Splunk Enterprise below 9.4.14, 10.0.9, 10.2.6, and 10.4.2. Root cause: Analytics Workspace fails to validate data used to build SPL searches. Impact: an unauthenticated attacker can phish an authenticated user via a crafted link; opening it executes attacker-controlled SPL with the vic...

CVE-2026-76333

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient URL validation in Dashboard Studio workflow actions. A user holding the "power" role can store a crafted URL in a workflow ac...

CVE-2026-76331

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, insufficient validation of caller-supplied time values in saved-search dispatch requests allows non-admin/power users to inject SPL via the REST API, enabling unauthorized data access and integrity compromise (CVSS 8.1, HIGH)...

CVE-2026-76331 SPL Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

CVE-2026-76329

Affected Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Root cause: Monitoring Console fails to validate dashboard search inputs. Attack vector: phishing an admin user to open a crafted link, causing attacker-controlled SPL execution with admin privileges. Impact: data expos...