Cyber Resilience

CVE-2026-76254

Splunk 9.3.0 – 9.3.14

Published
19 August 2026
Modified
21 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0031 24th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2026-76254 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Splunk Splunk. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for…

more

access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands to those searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Explore a dataset (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/manage-and-explore-datasets/explore-a-dataset) and SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.

CWE(s)
CWE-943

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-76331Same product: Splunk Splunk
CVE-2026-76316Same product: Splunk Splunk
CVE-2026-76344Same product: Splunk Splunk
CVE-2026-76354Same product: Splunk Splunk
CVE-2026-76317Same product: Splunk Splunk
CVE-2023-22942Same product: Splunk Splunk
CVE-2026-76355Same product: Splunk Splunk
CVE-2026-20253Same product: Splunk Splunk
CVE-2024-36984Same product: Splunk Splunk
CVE-2026-76336Same product: Splunk Splunk

Affected Assets

splunk
splunk
9.3.0 — 9.3.14 · 9.4.0 — 9.4.14 · 10.0.0 — 10.0.9

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Input validation directly stops unneutralized special elements from reaching query logic.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for controls against injection and improper query construction.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements in all data queries.

A.8.30 Outsourced development partial match
prevents

Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.

References