Splunk Enterprise CVE-2026-76254

The essential prerequisite is that an authenticated Splunk Enterprise user with access to the Dataset Explorer feature must open a crafted link delivered by the attacker - the attack cannot proceed without this victim interaction. The victim must have an active, valid Splunk session at the time they click the link; session expiry or MFA step-up requirements that force re-authentication before Dataset Explorer access would interrupt exploitation. The attacker requires no Splunk credentials or network access beyond the ability to deliver a link to the target. The Dataset Explorer feature must be accessible to the victim's assigned role; users or roles for which Dataset Explorer is not enabled cannot be exploited through this path. No non-default server-side configuration is required - Dataset Explorer is a standard Splunk Enterprise component. Exploitation impact is directly bounded by the victim's privilege level: a low-privilege analyst yields data-scoped impact, while an admin-level victim enables broader system integrity and availability effects. The vulnerability cannot be exploited autonomously or at scale without repeated individual phishing lures.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the threat profile: the attack is network-delivered, requires no Splunk credentials from the attacker, and carries full confidentiality, integrity, and availability impact against the victim user's data and session context. The sole friction point is UI:R - the victim must open a crafted link - which prevents fully automated mass exploitation but is a well-understood and frequently successful social engineering vector, particularly in enterprise environments where users receive Splunk-related links routinely. No EPSS score was supplied in the source data, so exploitation probability cannot be quantified from empirical telemetry; it must instead be inferred from structural factors, namely the low technical barrier to crafting the payload and the wide footprint of Splunk Enterprise in SOC and IT operations environments. No CISA KEV listing is present and no public POC has been identified, indicating active exploitation has not yet been broadly observed; however, the attack mechanism is straightforwardly derivable from the description, and the time-to-exploit window post-advisory is typically short for clearly described injection flaws. No conflicts between the CVSS vector and the description were identified - the network attack vector and required user interaction are both corroborated by the phishing-delivery mechanism stated in the advisory.

An unauthenticated attacker constructs a Splunk Enterprise Dataset Explorer URL embedding SPL commands within a crafted dataset name - for example, injecting a search pipeline that exfiltrates index contents to an external destination - and delivers this URL to a logged-in Splunk user via a phishing email or instant message. When the victim clicks the link, their authenticated browser session triggers Dataset Explorer to build and execute the injected SPL pipeline under their full session privileges, potentially exposing sensitive security log data or disrupting search availability. No public POC has been identified at time of analysis, but the attack requires only URL crafting and social engineering delivery, with no exploitation of memory corruption or binary exploitation primitives.