CVE-2026-76387 in Enterprise Security
Summary
by MITRE • 08/20/2026
In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could inject Search Processing Language (SPL) through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is possible because the Analyst Queue search filter handling does not validate filter field names before the fields are included in SPL searches. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security), Manage analyst workflows using the analyst queue in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.4/mission-control/manage-analyst-workflows-using-the-analyst-queue-in-splunk-enterprise-security), and Overview of Mission Control in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.5/mission-control/overview-of-mission-control-in-splunk-enterprise-security) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Splunk Enterprise Security versions prior to 8.6.1 contain a critical input validation flaw within the Analyst Queue search filter handling mechanism that allows for Search Processing Language injection. This vulnerability specifically affects users assigned roles containing the mc_investigation_read capability, which is designed to grant read-only access to investigation-related data and workflows. The core technical deficiency lies in the application's failure to validate or sanitize field names provided by the user before these fields are incorporated into underlying SPL searches executed on behalf of that user. Because the system blindly trusts the structure and content of filter inputs without rigorous schema validation, an attacker can manipulate these input parameters to inject arbitrary SPL commands rather than simple field identifiers.
The operational impact of this vulnerability is severe as it effectively bypasses intended access controls for users who are supposed to have limited investigative privileges. By injecting malicious SPL code through the Analyst Queue search filters, a compromised or malicious user with mc_investigation_read rights can escalate their permissions beyond read-only access. This injection allows the attacker to execute commands that provide access to all relevant data and system integrity available to the scheduled searches running under the context of the affected user account. Consequently, this leads to unauthorized data exfiltration, potential modification or deletion of security events, and a complete compromise of the confidentiality and integrity guarantees provided by the role-based access control model within Splunk Enterprise Security.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the injection of executable code via user-supplied input that is not properly validated. In terms of adversary tactics and techniques, this flaw facilitates privilege escalation and unauthorized data access consistent with ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials or roles to gain initial access and then leverages system misconfigurations to expand their scope of influence within the environment. The lack of strict input validation on filter fields represents a fundamental failure in secure coding practices regarding parameterized queries and context-aware parsing of user inputs.
To mitigate this vulnerability, organizations running Splunk Enterprise Security versions below 8.6.1 must immediately upgrade to version 8.6.1 or later where the issue has been resolved through improved input validation logic. Until an upgrade is feasible, administrators should review role assignments carefully and restrict the mc_investigation_read capability only to trusted personnel who require it for their specific duties. Additionally, implementing network-level access controls such as firewalls or web application firewalls can help limit exposure by restricting which IP addresses are allowed to interact with the Splunk Enterprise Security interface. Regular auditing of user activities within the Analyst Queue and monitoring for anomalous SPL query patterns can also aid in detecting potential exploitation attempts before significant damage occurs.