CVE-2026-76387: Splunk Enterprise Security SQLi Vulnerability

CVE-2026-76387 Overview

CVE-2026-76387 is a Search Processing Language (SPL) injection vulnerability in Splunk Enterprise Security versions below 8.6.1. An authenticated user holding a role with the mc_investigation_read capability can inject SPL through Analyst Queue search filters. The root cause is improper input validation [CWE-20] where filter field names are not validated before inclusion in SPL searches. Successful exploitation grants access to data and system integrity available to scheduled searches running under the targeted user context.

Critical Impact
An authenticated Splunk Enterprise Security user with the mc_investigation_read capability can inject arbitrary SPL and access all data available to scheduled searches for that user, compromising confidentiality and integrity of security investigation data.

Affected Products

Splunk Enterprise Security versions below 8.6.1
Splunk Enterprise Security Mission Control Analyst Queue component
Deployments with users assigned the mc_investigation_read capability

Discovery Timeline

2026-08-19 - CVE-2026-76387 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76387

Vulnerability Analysis

The vulnerability resides in the Analyst Queue search filter handling within Splunk Enterprise Security Mission Control. When a user submits a filter, the application concatenates filter field names into SPL queries without validating that those names conform to an expected allowlist. An authenticated user with the mc_investigation_read capability can supply crafted field names that break out of the intended SPL context and append arbitrary search commands.

Injected SPL executes with the effective permissions of the scheduled searches that run for that user. This exposes indexes, saved searches, and lookups that the analyst account can reach through scheduled search execution. The impact spans both confidentiality of investigation data and integrity of search results relied upon for downstream detection workflows.

Root Cause

The underlying flaw is missing input validation on filter field names before they are interpolated into SPL statements. The Analyst Queue component trusts client-supplied field identifiers instead of validating them against the defined data model schema. This is a classic input validation weakness classified under [CWE-20].

Attack Vector

Exploitation requires network access to the Splunk Enterprise Security web interface and valid credentials for an account holding the mc_investigation_read capability. No user interaction is required beyond the authenticated attacker submitting the crafted filter. The attacker interacts with the Analyst Queue filtering UI or its underlying API and supplies malicious SPL fragments as filter field names. Because the injected SPL runs in the context of scheduled searches, the attacker can query indexes and pivot to data the account would not normally access through the standard Mission Control UI.

No public proof-of-concept exploit code has been published. Refer to the Splunk Security Advisory SVD-2026-0807 for vendor technical details.

Detection Methods for CVE-2026-76387

Indicators of Compromise

Unexpected SPL commands in _internal audit logs originating from Mission Control Analyst Queue API endpoints
Analyst Queue filter requests containing SPL metacharacters such as pipe (|), backticks, or macro invocations in field name parameters
Scheduled search executions returning data outside the user's normal investigation scope
Sudden increases in search volume or unusual index access patterns from accounts holding mc_investigation_read

Detection Strategies

Audit search.log and audit.log entries for SPL patterns invoked through Analyst Queue workflows that reference indexes unrelated to investigations
Alert on Analyst Queue filter requests where field names contain characters outside the expected identifier grammar
Baseline scheduled search behavior per analyst role and flag deviations in indexes queried or commands executed

Monitoring Recommendations

Enable detailed REST API audit logging for Mission Control endpoints and forward to a centralized analytics platform
Review role assignments to identify all accounts currently granted the mc_investigation_read capability
Monitor for privilege escalation patterns where analyst-tier accounts access administrative indexes through scheduled search context

How to Mitigate CVE-2026-76387

Immediate Actions Required

Upgrade Splunk Enterprise Security to version 8.6.1 or later as the primary remediation
Inventory all users and roles assigned the mc_investigation_read capability and remove it from accounts that do not require Analyst Queue read access
Rotate credentials for accounts suspected of exploitation and review scheduled search results generated during the exposure window

Patch Information

Splunk has addressed CVE-2026-76387 in Splunk Enterprise Security 8.6.1. Administrators should follow the upgrade guidance in the Splunk Security Advisory SVD-2026-0807. Validate the upgrade against test environments before rolling out to production Enterprise Security deployments.

Workarounds

Restrict the mc_investigation_read capability to a minimal set of trusted analyst accounts until the patch is applied
Disable or restrict access to the Analyst Queue component in Mission Control for non-essential users
Increase monitoring on scheduled searches associated with analyst accounts and review outputs for anomalous data access

bash

# Review roles that grant the vulnerable capability
# Run against the Splunk search head hosting Enterprise Security
| rest /services/authorization/roles \
  | search capabilities="mc_investigation_read" \
  | table title capabilities