Vulnpedia
← All CVEs

CVE-2026-76330

HIGH 7.1

Published 2026-08-19 · Last modified 2026-08-21

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build forwarder dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

ELEVATED IMPACT

Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 16th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.1CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: A user must take an action (click / open a file)
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-76330/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-76330/poc.json

Affected

Vendors Splunk

Products Splunk Enterprise Splunk

Weakness (CWE)

  • CWE-20: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Known Affected Software Configurations

VendorProductVersion range
SplunkSplunk≥ 9.4.0 and < 9.4.14
SplunkSplunk≥ 10.0.0 and < 10.0.9
SplunkSplunk≥ 10.2.0 and < 10.2.6
SplunkSplunk≥ 10.4.0 and < 10.4.2

All CVSS metrics

  • HIGH 7.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
  • HIGH 7.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

Advisories

Sources: NVD · CVE.org · EPSS