CVE-2026-76252
Splunk Splunk
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
- To exploit it, no account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 6.8 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N- Weakness
- CWE-79
- Assigned by
- psirt@cisco.com
Dates
- Published
- 2026-08-19
- Last modified
- 2026-08-26
- Sources
- NVD
Affected products
- Splunk Splunk9.4.0 - 9.4.13, 10.0.0 - 10.0.9, 10.2.0 - 10.2.6, 10.4.0 - 10.4.2
As listed in the NVD configuration data. Not a statement about your estate.