CVE-2026-76309 Splunk CVE debrief

Who should care

Organizations using Splunk Enterprise, particularly those with low-privileged users accessing the REST API, should be aware of this vulnerability and take steps to mitigate it. This includes applying patches for affected versions, restricting access to the REST API for low-privileged users, and monitoring for suspicious activity on the REST API. Additionally, organizations should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Technical summary

A low-privileged user can inject SQL through the REST API in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, allowing attacker-controlled text to be evaluated as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization. This vulnerability can be mitigated by applying patches for affected versions, restricting access to the REST API for low-privileged users, and monitoring for suspicious activity on the REST API.

Defensive priority

Organizations using Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

• Apply patches for Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
• Restrict access to the REST API for low-privileged users
• Monitor for suspicious activity on the REST API
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the SQL injection vulnerability in Splunk Enterprise. Vendor advisory is available for mitigation. A low-privileged user can inject SQL through the REST API in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, allowing attacker-controlled text to be evaluated as part of a database query. Organizations using Splunk Enterprise, particularly those with low-privileged users accessing the REST API, should be aware of this vulnerability and take steps to mitigate it. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Official resources