Vulnerability in Splunk
CVE-2026-76329
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (15.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
Weakness classification (CWE)
References
- advisory.splunk.com/advisories/SVD-2026-0801 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-76329?
- CVE-2026-76329 is a medium-severity vulnerability in Splunk, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 6.4/10. Published 2026-08-19.
- How severe is CVE-2026-76329?
- Medium severity. CVSS v3 base score is 6.4 out of 10.