CVE-2026-76323 is a medium severity (6.4) input validation flaw in Splunk Enterprise. The Job Details dashboard places a caller-supplied search identifier into SPL searches without neutralizing it, so a crafted link can bypass the safeguards for risky commands. Fixed in 10.4.2, 10.2.6, 10.0.9 and 9.4.14. Turning Splunk Web off is a listed workaround.
What's affected
The record lists Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9 and 9.4.14. The component is the Job Details dashboard.
Splunk's advisory table lists the affected and fixed Splunk Enterprise versions for the whole August 2026 advisory:
- 10.4 line: 10.4.0 to 10.4.1, fixed in 10.4.2
- 10.2 line: 10.2.0 to 10.2.5, fixed in 10.2.6
- 10.0 line: 10.0.0 to 10.0.8, fixed in 10.0.9
- 9.4 line: 9.4.0 to 9.4.13, fixed in 9.4.14
Where sources differ. The record and the advisory agree on versions and on 6.4 Medium for this CVE.
How to check if you're exposed
Find your version first. On the Splunk host, run:
$SPLUNK_HOME/bin/splunk version
Compare the result with the fixed versions above. Then check whether Splunk Web is running on that instance, because Splunk lists turning Splunk Web off as a workaround for this issue, which tells you the vulnerable code sits in the web interface. The web.conf specification and Splunk's guidance on disabling unnecessary components describe how the web server is controlled.
Also list who can reach Splunk Web. A flaw that depends on a user opening a crafted link matters most where many people log in with broad roles.
What to do now
- Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9 or 9.4.14, or higher, as Splunk's advisory directs.
- If you cannot upgrade this week and nobody needs the web interface on that instance, turning Splunk Web off is the workaround Splunk lists.
- Remind users with search access to treat unexpected links into Splunk Web with suspicion, especially links that open a dashboard or explorer view.
- Review which roles can run searches and which hold the admin and power roles, so a phished session carries as little as possible.
- Re-check the version after the upgrade and note it in your asset record.
Why it matters
The Job Details dashboard takes a search identifier from the request and puts it into SPL. If that value is not neutralized, it can carry extra search commands. Splunk's safeguards for risky commands are meant to catch exactly this, and the bypass is why the record files it under CWE-20, improper input validation.
The attacker needs an account without admin or power roles and a victim who opens the crafted link. The injected SPL then runs with that victim's permissions. If you take one lesson from the five Splunk Web issues in this advisory, it is that links into admin tools deserve the same suspicion as attachments. The record does not mark this one as a CISA KEV entry.
Quick check
What input is not neutralized?
The record says a caller-supplied search identifier that the Job Details dashboard places into SPL searches.
Who needs to click the link?
An authenticated user. Their permissions determine what the injected SPL can do.
Sources
Last reviewed: 18 October 2026.
