Splunk Enterprise CVE-2026-76329

Exploitation requires that a Splunk user holding the built-in 'admin' role be socially engineered into opening a specially crafted URL pointing to the Monitoring Console - the attacker cannot trigger query execution without this user interaction (CVSS UI:R). The Monitoring Console must be network-reachable such that the crafted URL resolves (AV:N), but the admin need only click the link from any browser session where they are authenticated to Splunk. The attacker requires no Splunk credentials (PR:N). Exploitation is concretely limited by: (1) the mandatory phishing step targeting specifically an 'admin'-role user - non-admin users executing the link would run SPL only at their own lower permission level; (2) high attack complexity (AC:H) reflecting the social engineering prerequisite; and (3) the attacker's inability to exploit at will as stated explicitly in the CVE description. Default Splunk Enterprise installations with Monitoring Console enabled are in scope - no non-default feature flag is required beyond the admin role assignment.

The CVSS 6.4 score reflects meaningful real-world friction: AC:H and UI:R together encode the social engineering dependency - the attacker cannot exploit at will and must successfully phish a specific administrative user. AV:N and PR:N indicate no attacker authentication is required and the attack originates over the network, but these are offset by the targeting constraint. C:H is the most consequential signal: Splunk administrators typically have access to security logs, operational telemetry, and sensitive business data across the entire indexed dataset - successful exploitation could be a significant breach. I:L reflects the ability to modify lookup data, which in security workflows (e.g., threat intel lookups, allowlists) could introduce subtle integrity issues. No EPSS score was provided in the input and the CVE does not appear in CISA KEV, so no confirmed active exploitation or widespread targeting is established. The absence of a public POC further suggests this is not currently an automated exploitation risk. Overall assessment: genuine medium-high priority for organizations with phishable Splunk admins or internet-exposed Monitoring Consoles, but not a mass-exploitation scenario requiring emergency response.

An attacker with no Splunk credentials identifies a Splunk administrator via LinkedIn or organizational directory, then crafts a malicious URL targeting the Monitoring Console with embedded SPL that exfiltrates search results to an attacker-controlled destination - for example, injecting a SPL query that reads sensitive indexed data and pipes it via makeresults or outbound lookup. The attacker delivers the link via a convincing phishing email (e.g., spoofed Splunk alert notification), and when the admin clicks it, Splunk executes the injected SPL under admin permissions, silently leaking indexed data or corrupting a threat intelligence lookup table. No public proof-of-concept code has been identified at time of analysis.