Splunk Enterprise CVE-2026-76349

The attack requires two concrete conditions to be satisfied simultaneously: first, the target must be running Splunk Web (the browser-based interface) on an unpatched version within the 9.4, 10.0, or 10.2 branches; second, an authenticated Splunk user must be socially engineered into clicking the crafted URL while their session is active. The attacker cannot exploit this vulnerability at will or without victim interaction - the CVSS UI:R and AC:H ratings directly reflect this dependency. Exploitation is limited by the need for the victim to have an active authenticated Splunk session, the attacker's ability to deliver and have a phishing link clicked, and the victim's permission scope (data accessible is bounded by the victim's Splunk role). Splunk Enterprise 10.4+ is immune regardless of configuration.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L yields a score of 6.4 (Medium), which accurately reflects the attack's meaningful friction: AC:H and UI:R jointly require the attacker to successfully phish an authenticated Splunk user, a non-trivial social engineering dependency that substantially limits opportunistic exploitation. Confidentiality impact is rated High because SPL can query all data the victim user is authorized to access - in practice, this often means broad visibility into security logs and sensitive operational data in SIEM deployments. Integrity and availability impacts are Low, reflecting that SPL primarily reads data rather than writes or deletes it. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been reported by the source data, indicating no confirmed active exploitation or public weaponization at time of analysis. The overall risk profile is: low priority for bulk-exploitation scenarios, but elevated for targeted attacks against high-value Splunk administrators or security analysts whose sessions would yield access to sensitive indexed data.

An attacker identifies a target organization's Splunk deployment and crafts a Splunk Web URL containing malicious SPL tokens in the query string - for example, injecting a search that exfiltrates indexed credentials or PII to an external lookup. The attacker then sends this URL to a Splunk analyst or SOC operator via a phishing email or message, posing as an internal alert or dashboard share. When the victim, already authenticated to Splunk, clicks the link, Splunk Web substitutes the attacker-controlled token values into a live SPL search executed under the victim's permissions, potentially returning sensitive indexed data that the attacker can capture via the browser.