CVE-2026-76321

SPL Injection through Nearby Event Searches in Splunk Enterprise

State: Published
Severity: 7.3 High
Published: Aug 19, 2026
Updated: Aug 27, 2026
Reserved: Aug 19, 2026

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	cisco

Weaknesses

CWE-77 The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.2Affected 10.2 to before 10.2.6Affected 10.0 to before 10.0.9Affected 9.4 to before 9.4.14Affected

References

https://advisory.splunk.com/advisories/SVD-2026-0801

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.