CVE-2026-76254 is a high severity (7.5) flaw in Splunk Enterprise. Dataset Explorer builds searches from dataset names without escaping them, so a phished user could run attacker-chosen SPL with their own privileges. Splunk fixed it in 10.4.2, 10.2.6, 10.0.9 and 9.4.14. Turning Splunk Web off is the listed workaround.
What's affected
The record says Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14 and 9.3.14 are affected. The component is Dataset Explorer in Splunk Web.
Splunk's advisory table lists the affected and fixed Splunk Enterprise versions for the whole August 2026 advisory:
- 10.4 line: 10.4.0 to 10.4.1, fixed in 10.4.2
- 10.2 line: 10.2.0 to 10.2.5, fixed in 10.2.6
- 10.0 line: 10.0.0 to 10.0.8, fixed in 10.0.9
- 9.4 line: 9.4.0 to 9.4.13, fixed in 9.4.14
Where sources differ. The record's text and the advisory's CVE entry both name 9.3.14 as a fixed boundary, but the advisory's product status table has no 9.3 row and tells customers to move to 10.4.2, 10.2.6, 10.0.9 or 9.4.14. If you still run 9.3, check the advisory directly and plan a move to a listed line. Severity matches: both give 7.5 High with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find your version first. On the Splunk host, run:
$SPLUNK_HOME/bin/splunk version
Compare the result with the fixed versions above. Then check whether Splunk Web is running on that instance, because Splunk lists turning Splunk Web off as a workaround for this issue, which tells you the vulnerable code sits in the web interface. The web.conf specification and Splunk's guidance on disabling unnecessary components describe how the web server is controlled.
Also list who can reach Splunk Web. A flaw that depends on a user opening a crafted link matters most where many people log in with broad roles.
What to do now
- Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9 or 9.4.14, or higher, as Splunk's advisory directs.
- If you cannot upgrade this week and nobody needs the web interface on that instance, turning Splunk Web off is the workaround Splunk lists.
- Remind users with search access to treat unexpected links into Splunk Web with suspicion, especially links that open a dashboard or explorer view.
- Review which roles can run searches and which hold the admin and power roles, so a phished session carries as little as possible.
- Re-check the version after the upgrade and note it in your asset record.
Why it matters
The cause, in Splunk's words, is that Dataset Explorer does not validate or escape dataset names before building SPL searches, and it does not apply the SPL safeguards for risky commands to those searches. That is injection into a query language, which the Gold directory files under CWE-943.
Two things limit it. The attacker is unauthenticated but cannot act at will: a user has to be tricked into opening a crafted link, which is why attack complexity is rated high and user interaction is required. And the injected SPL runs with the victim's privileges, so the damage scales with the role of the person who clicks. An admin who is phished is a much worse day than a read-only analyst. The record does not list this as a CISA Known Exploited Vulnerability.
Quick check
Does an attacker need a Splunk account?
The record says the attacker is unauthenticated. What they do need is a user to open a crafted link, and the code that runs uses that user's privileges.
What is the stopgap if I cannot patch yet?
Splunk lists turning Splunk Web off as a workaround. That only works if nobody needs the web interface on that instance, so treat it as temporary.
Sources
Last reviewed: 18 October 2026.
