Answer in brief
CVE-2026-76322 records a Medium severity (CVSS 6.7) vulnerability in SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise. The current sources do not mark it as known exploited. The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Splunk/Splunk Enterprisegeneric | >=10.4 <10.4.2 || >=10.2 <10.2.6 || >=10.0 <10.0.9 || >=9.4 <9.4.14 | 10.4.2, 10.2.6, 10.0.9, 9.4.14 |
Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 19, 2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "user" Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/dashboard-studio/10.4/use-data-sources/create-search-based-visualizations-with-ds.search) in the Splunk documentation.
Quoted source text, attributed separately from HOL analysis.