CVE-2026-76339 Overview
CVE-2026-76339 is a Search Processing Language (SPL) command injection vulnerability in Splunk Enterprise. The flaw resides in the geostats command, which fails to validate user input before Splunk processes it. A low-privileged user who does not hold the admin or power roles can craft malicious SPL that executes with the permissions of another authenticated user. Exploitation requires phishing the target into initiating an attacker-controlled geostats search inside Splunk Web. Successful exploitation exposes data accessible to the second user, including stored credentials, and permits modification of lookup files.
Critical Impact
A low-privileged attacker can steal data and stored credentials from higher-privileged users and modify lookup files after phishing the victim into loading a crafted geostats search in Splunk Web.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6, 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76339 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76339
Vulnerability Analysis
The vulnerability is a command injection flaw [CWE-77] in the Splunk geostats search command. Splunk Enterprise processes SPL input passed to geostats without sufficient validation. An attacker with a low-privileged account can embed additional SPL commands inside a crafted geostats query. When a higher-privileged user initiates that search in Splunk Web, the injected SPL executes in the victim's session context.
The injected SPL inherits the victim's role assignments and data access. This grants read access to any indexes and stored credentials the victim can retrieve. The attacker can also write to lookup files that the victim has permission to modify, enabling tampering with downstream detection logic or enrichment data.
Root Cause
The geostats command does not sufficiently validate SPL parameters before Splunk Enterprise executes them. Attacker-controlled strings pass through into the search pipeline and are interpreted as additional SPL commands rather than treated as inert data. This aligns with CWE-77: Improper Neutralization of Special Elements used in a Command.
Attack Vector
Exploitation is network-based but requires user interaction. The attacker authenticates to Splunk with a non-privileged account, then constructs a URL or link that triggers a geostats search containing injected SPL. The attacker phishes a higher-privileged user into clicking that link while logged into Splunk Web. Once the victim's browser initiates the search, the injected SPL runs under the victim's identity. The attack cannot be triggered at will by the low-privileged user without the victim's participation, which limits reliability but does not prevent exploitation.
See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.
Detection Methods for CVE-2026-76339
Indicators of Compromise
- Search audit entries showing geostats commands containing unexpected pipe characters, subsearches, or SPL keywords such as outputlookup, rest, or sendemail inside geostats parameters.
- Search invocations where the initiating user is admin or power but the referring URL originated from an external site or an unrelated Splunk dashboard.
- Unexpected modifications to lookup files (*.csv under $SPLUNK_HOME/etc/apps/*/lookups/) timestamped shortly after a geostats search.
Detection Strategies
- Review the _audit index for action=search events with search=*geostats* and parse the raw SPL for injection markers such as embedded pipes or nested commands.
- Alert on geostats searches executed by privileged users where the search string was supplied via an inbound HTTP referrer rather than typed interactively.
- Correlate rest or | inputlookup splunk_secrets invocations that appear inside geostats pipelines with the account role of the executing user.
Monitoring Recommendations
- Enable and forward Splunk Web access logs and the _audit index to a central analytics platform for retention and correlation.
- Monitor lookup file integrity through file integrity monitoring on $SPLUNK_HOME/etc/apps/*/lookups/ directories.
- Track authentication and search activity for accounts with the admin or power roles to identify anomalous search patterns triggered from external contexts.
How to Mitigate CVE-2026-76339
Immediate Actions Required
- Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, matching the maintenance track in use.
- Instruct users holding the admin or power roles to avoid clicking Splunk Web links delivered through email, chat, or external sites until patched.
- Audit stored credentials accessible through the rest endpoint and rotate any that may have been exposed.
Patch Information
Splunk has released fixed versions in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 release lines. Refer to Splunk Security Advisory SVD-2026-0801 for the authoritative version matrix and download links.
Workarounds
- Restrict use of the geostats command through SPL safeguards or capability restrictions where feasible until patches are applied.
- Enforce SameSite cookie attributes and CSRF protections on Splunk Web to reduce the reliability of cross-site request-based phishing.
- Deliver targeted phishing awareness training to Splunk users with the admin and power roles, emphasizing the risk of clicking untrusted links while authenticated to Splunk Web.
# Verify the running Splunk Enterprise version
$SPLUNK_HOME/bin/splunk version
# Review recent geostats searches for signs of SPL injection
index=_audit action=search search="*geostats*"
| rex field=search "geostats(?<geo_args>[^|]*)"
| search geo_args="*|*" OR geo_args="*outputlookup*" OR geo_args="*rest *"
| table _time user search host
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
