Improper Neutralization of Special Elements in Data Query Logic in Splunk Enterprise - CVE-2026-76295
Published: October 22, 2026
Vulnerability identifier: #VU156979
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76295
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to view dashboard and report listings beyond the requested filter scope.
The vulnerability exists due to improper neutralization of special characters in Splunk Secure Gateway REST API filter construction when processing dashboard and report requests. A remote user can supply crafted filter values to inject SPL syntax and retrieve listings beyond the requested filter scope.
Returned listings remain limited to objects that the requesting user is permitted to access.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76295
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4