CVE-2026-76331 SPL Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

CVE-2026-76331

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, insufficient validation of caller-supplied time values in saved-search dispatch requests allows non-admin/power users to inject SPL via the REST API, enabling unauthorized data access and integrity compromise (CVSS 8.1, HIGH)...

CVE-2026-76317

Splunk Enterprise lookup configuration REST API fails to resolve source paths before boundary checks, enabling non-admin users to exfiltrate files into controlled lookups. Affected versions: 9.4.14, 10.0.9, 10.2.6, 10.4.2 and below. CVSS 8.8 HIGH. No in-the-wild exploitation reported. See https:/...

CVE-2026-76317 Path Traversal through the Lookup Configuration REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could then access all relevant data and...

CVE-2026-76315

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by a privilege escalation vulnerability in Splunk Web Manager Configuration . The root cause is that the REST API path for manager configuration does not enforce the permission that normally controls manager configur...

CVE-2026-76315 Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect syste...

CVE-2026-76313 Remote Code Execution (RCE) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

CVE-2026-76313

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the REST API knowledge bundle upload endpoint lacks the edit_dist_peer capability check, allowing non-admin users to upload malicious bundles used by distributed search, enabling RCE. Splunk's advisory (SVD-2026-0801) provide...

CVE-2026-76309 Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language SQL through the Representational State Transfer REST API, causing Splunk Enterprise to evaluate...

CVE-2026-76309

CVE-2026-76309 is a SQL injection vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A low-privileged user (without the "admin" or "power" role) can inject SQL through the REST API by supplying crafted filter values that are incorporated into database queries w...

CVE-2026-76310 Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76310

An unauthenticated user with an embedded report token can download the search job dispatch archive via REST API, recover session material, and access all data available to the report owner—including admin-level actions—due to embedded report access not blocking dispatch archive downloads. Affecte...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76262 Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

CVE-2026-76261 Insecure Default Access Control List through the REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

CVE-2026-76261

Non-admin/low-privilege users on Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) can read Spacebridge asymmetric private keys via the App Key Value Store REST API. The root cause is incomplete private-key migration during upgrade, leaving...

CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...

CVE-2026-76260

CVE-2026-76260 is an incorrect permission assignment vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The properties REST endpoint checks for the rest_properties_get capability instead of the more restrictive list_storage_passwords capability, allow...

CVE-2026-76256

CVE-2026-76256 is an information disclosure vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (versions below 3.10.9, 3.9.23, 3.8.70). The root cause is that SAML setup and instance settings REST API endpoints do not enforce authorization...