CVE-2026-76321 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical security vulnerability exists within specific versions of Splunk Enterprise, including releases prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. This flaw allows an unauthenticated attacker to inject arbitrary Search Processing Language commands into the application by exploiting the functionality designed for searching events near a selected event. The core technical issue stems from inconsistent input validation within Splunk Web when constructing SPL queries. Specifically, caller-supplied values are not consistently escaped during the generation of search strings intended to locate nearby events. This lack of proper sanitization creates an injection vector that bypasses standard security controls.
The operational impact of this vulnerability is severe because it facilitates unauthorized search execution. An attacker can leverage this flaw to execute arbitrary SPL commands without requiring valid authentication credentials. Furthermore, the vulnerability is exacerbated by a failure in access control logic related to embedded reports. The system accepts these maliciously crafted requests for nearby-event searches while failing to perform the expected authorization checks that would normally restrict such actions to authenticated and authorized users only. This combination of input validation failures and broken access controls effectively grants unauthenticated actors significant capabilities within the Splunk environment, potentially leading to data exfiltration or further compromise depending on the privileges associated with the injected commands.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, although in this context it manifests specifically as Command Injection via SPL rather than script injection into HTML output. It also relates to CWE-284, indicating Improper Access Control, due to the bypassed authorization checks for embedded report access and search execution. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques, as it allows an attacker to execute arbitrary commands within the application environment through injected SPL syntax.
Mitigation strategies require immediate action by system administrators responsible for maintaining Splunk Enterprise instances. The primary remediation is to upgrade all affected systems to a patched version of Splunk Enterprise that addresses these specific flaws in input handling and access control verification. Until patching can be performed, organizations should implement strict network-level controls such as firewall rules or web application firewalls to restrict access to the Splunk Web interface from untrusted networks. Additionally, enabling comprehensive logging and monitoring for unusual SPL query patterns can help detect potential exploitation attempts in real-time. It is also advisable to review embedded report configurations to ensure that no sensitive data remains accessible through endpoints vulnerable to this injection vector until a permanent fix is deployed.