In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.
Improper Input Validation through the collect Command in Splunk Enterprise
Problem type
Affected products
Splunk
< 10.4.3 - AFFECTED
< 10.2.7 - AFFECTED
< 10.0.10 - AFFECTED
< 9.4.15 - AFFECTED
References
GitHub Security Advisories
GHSA-9r8v-pv92-mr8q
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role...
https://github.com/advisories/GHSA-9r8v-pv92-mr8qIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-76273Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-76273",
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"dateUpdated": "2026-10-08T13:35:47.065Z",
"dateReserved": "2026-08-19T12:02:03.620Z",
"datePublished": "2026-10-07T20:46:33.936Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco",
"dateUpdated": "2026-10-07T20:46:33.936Z"
},
"datePublic": "2026-10-07T00:00:00.000Z",
"title": "Improper Input Validation through the collect Command in Splunk Enterprise",
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.",
"supportingMedia": [
{
"type": "text/markdown",
"base64": false,
"value": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the `run_collect` capability could use the `collect` Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the `collect` command does not validate the index name before processing the value. For more information see [collect](https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), [Define roles on the Splunk platform with capabilities](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and [System endpoint descriptions](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation."
}
]
}
],
"affected": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"modules": [
"splunkd"
],
"versions": [
{
"version": "10.4",
"status": "affected",
"versionType": "custom",
"lessThan": "10.4.3"
},
{
"version": "10.2",
"status": "affected",
"versionType": "custom",
"lessThan": "10.2.7"
},
{
"version": "10.0",
"status": "affected",
"versionType": "custom",
"lessThan": "10.0.10"
},
{
"version": "9.4",
"status": "affected",
"versionType": "custom",
"lessThan": "9.4.15"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.",
"cweId": "CWE-20",
"type": "cwe"
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-1001"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher."
}
],
"credits": [
{
"lang": "en",
"value": "Anton (therceman)",
"type": "reporter"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-08T13:35:47.065Z"
},
"title": "CISA ADP Vulnrichment",
"metrics": [
{}
]
}
]
}
}