CVE-2026-76329— SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise
Quick assessment
Affected
Splunk Splunk Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Splunk Enterprise 10.4.2、10.2.6、10.0.9 和 9.4.14 之前的版本中，存在一个未认证用户可利用的漏洞。攻击者可以诱导持有 Splunk “admin” 角色的用户点击一个精心构造的链接，该链接指向 Monitoring Console（监控控制台）。当该用户打开此链接时，Splunk Enterprise 会以该用户的权限执行由攻击者控制的搜索处理语言（SPL）。注入的 SPL 可能导致该用户可访问的数据泄露，或篡改查找表（lookup）数据。 该漏洞的根本原因在于，Mo
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4< 10.4.2 |
affected |
10.2< 10.2.6 |
affected | ||
10.0< 10.0.9 |
affected | ||
9.4< 9.4.14 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76329
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise
Source: CVE Program / CVE List V5
Vulnerability Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4 ~ 10.4.2 | - |
|
II. Public POCs for CVE-2026-76329
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76329
请登录查看更多情报信息。
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76350 | 8.8 HIGH | Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk En |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76259 | 8.8 HIGH | Improper Privilege Management on the Management Port in Splunk Enterprise for Windows |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Splunk Enterprise
-
CVE-2026-76355
Unauthenticated Information Disclosure through an Edge Proce -
CVE-2026-76353
Path Traversal through Knowledge Bundle Replication in Splun -
CVE-2026-76354
Path Traversal through Search Head Clustering in Splunk Ente -
CVE-2026-76352
Improper Authorization through the REST API in Splunk Enterp -
CVE-2026-76351
Server-Side Request Forgery (SSRF) through the Report Notifi
Same vendor: Splunk
-
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector -
CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru -
CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST -
CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S
Same weakness: CWE-943
-
CVE-2026-77070
n8n before 1.123.69 NoSQL Injection via MongoDB Node -
CVE-2026-76363
Structured Query Language Injection through the REST API in -
CVE-2026-76349
SPL Injection through Splunk Web Form Tokens in Splunk Enter -
CVE-2026-76331
SPL Injection through the REST API in Splunk Enterprise -
CVE-2026-76327
SPL Injection through Splunk Web in Splunk Secure Gateway
V. Comments for CVE-2026-76329
No comments yet