← All CVEs

CVE-2026-76329

MEDIUM 6.4

Published 2026-08-19 · Last modified 2026-08-19

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 10th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

6.4CVSS 3.1 · MEDIUM

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityLow

What an attacker needs

  • Access: Reachable over the network — no local access needed
  • Privileges: No account or privileges required
  • User interaction: A user must take an action (click / open a file)
  • Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-76329/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-76329/poc.json

Affected

Vendors Splunk

Products Splunk Enterprise Splunk

Weakness (CWE)

  • CWE-943: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Known Affected Software Configurations

VendorProductVersion range
SplunkSplunk≥ 9.4.0 and < 9.4.14
SplunkSplunk≥ 10.0.0 and < 10.0.9
SplunkSplunk≥ 10.2.0 and < 10.2.6
SplunkSplunk≥ 10.4.0 and < 10.4.2

All CVSS metrics

  • MEDIUM 6.4 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
  • MEDIUM 6.4 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

References

Sources: NVD · CVE.org · EPSS