CVE-2026-76339 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users, especially those with limited roles, should be aware of this vulnerability and take necessary precautions to prevent exploitation. Affected operators should review their deployments for vulnerable versions and apply patches or updates. Platform administrators should verify that Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are updated. Vulnerability management teams should prioritize patching and monitor for suspicious geostats searches. Security teams should educate users on phishing risks and safe browsing practices to prevent exploitation.

Technical summary

The geostats command in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 does not sufficiently validate input, allowing a user without 'admin' or 'power' roles to inject arbitrary SPL commands. These commands run with the permissions of another authenticated user who initiates the attacker-controlled geostats search in Splunk Web. This could lead to exposure of sensitive data and modification of lookup files.

Defensive priority

Medium priority due to the required user interaction for exploitation

Recommended defensive actions

• Inventory and verify affected Splunk Enterprise versions
• Apply patches or updates to vulnerable versions
• Monitor for suspicious geostats searches
• Restrict user permissions to limit potential impact
• Educate users on phishing risks and safe browsing practices

Evidence notes

The CVE description provides details on the vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows a user without 'admin' or 'power' roles to inject arbitrary SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search in Splunk Web.

Official resources