Input validation error in Splunk Enterprise Security (ES) - CVE-2026-76387
Published: August 20, 2026
Vulnerability identifier: #VU144427
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76387
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access sensitive data and modify system integrity available to scheduled searches.
The vulnerability exists due to improper input validation in Analyst Queue search filter handling through the REST API when processing user-supplied filter field names in SPL searches. A remote user can inject crafted SPL through Analyst Queue search filters to access sensitive data and modify system integrity available to scheduled searches.
Exploitation requires a role that contains the mc_investigation_read capability.
Affected software
Splunk Enterprise Security (ES)
How to mitigate CVE-2026-76387
Install security update from vendor's website.
Splunk Enterprise Security (ES) - update to 8.6.1