CVE-2026-76329
CVE-2026-76329 is a medium-severity vulnerability in Splunk with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-943.
Key facts
- Severity: Medium (CVSS 3.x base score 6.4)
- EPSS exploit prediction: 0% (10th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-943
- Affected product: Splunk
- Published:
- Last modified:
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
Frequently asked questions
- What is CVE-2026-76329?
- In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
- How severe is CVE-2026-76329?
- CVE-2026-76329 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability low.
- Is CVE-2026-76329 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-76329?
- CVE-2026-76329 affects Splunk. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-76329?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-76329 published?
- CVE-2026-76329 was published on 2026-08-19 and last updated on 2026-08-21.
References
Affected products (1)
- cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
More vulnerabilities in Splunk
- CVE-2026-20253 — Critical (CVSS 9.8): In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or…
- CVE-2017-17067 — Critical (CVSS 9.8): Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and…
- CVE-2016-10126 — Critical (CVSS 9.8): Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12,…
- CVE-2026-76312 — Critical (CVSS 9.4): In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the…
- CVE-2026-76311 — Critical (CVSS 9.4): In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded…
- CVE-2026-76310 — Critical (CVSS 9.4): In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded…
Other CWE-943 vulnerabilities
- CVE-2026-40141 — Critical (CVSS 9.9): A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote…
- CVE-2024-4872 — Critical (CVSS 9.9): A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
- CVE-2026-41274 — Critical (CVSS 9.8): Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the…
- CVE-2026-40351 — Critical (CVSS 9.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…
- CVE-2026-32248 — Critical (CVSS 9.8): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
- CVE-2026-29793 — Critical (CVSS 9.8): Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0…