CVE-2026-76321

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.

Published 19 Aug 2026, 22:17 UTC Last modified 20 Aug 2026, 14:50 UTC

7.3

CVSS 3.1 HIGH base score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability Low

Exploitability3.9

Impact3.4

Affected products

Product applicability statements supplied with the NVD record.

VendorProductAffected version

Splunk Splunk from 9.4.0 (inclusive) before 9.4.14

Splunk Splunk from 10.0.0 (inclusive) before 10.0.9

Splunk Splunk from 10.2.0 (inclusive) before 10.2.6

Splunk Splunk from 10.4.0 (inclusive) before 10.4.2

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-77

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Vendor Advisory · Mitigation psirt@cisco.com