EUVD-2026-62896
GHSA-f473-74xq-6v94
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
PR:L because any authenticated non-admin/non-power Splunk account suffices; C:H and I:H because all indexed data is reachable and search integrity is compromised; A:N as availability is unaffected.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.
AnalysisAI
SPL injection in Splunk Enterprise exposes all indexed data and compromises search integrity for any low-privileged authenticated user. Specifically, users without the 'admin' or 'power' role can inject Search Processing Language commands into saved-search dispatch requests by supplying malicious time values that Splunk Enterprise fails to validate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Splunk Enterprise account that does not hold the 'admin' or 'power' role - meaning low-privileged users such as read-only analysts or custom-role users are the threat actors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity issue that is straightforward to exploit for any authenticated Splunk user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privileged Splunk analyst account - one without the 'admin' or 'power' role - submits a crafted saved-search dispatch request to the Splunk REST API, embedding injected SPL commands within the time value parameters. The injected SPL bypasses the access controls normally enforced by the user's role, allowing the attacker to search and exfiltrate indexed data from across the Splunk instance, including data from security logs, business intelligence, or other sensitive sources they would not ordinarily be permitted to query. |
| Remediation | The primary fix is to upgrade Splunk Enterprise to the patched versions released by the vendor: 10.4.2, 10.2.6, 10.0.9, or 9.4.14 depending on the deployed release branch, as detailed in Splunk advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Splunk Enterprise instances in your environment and verify their version against affected releases in the vendor advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today