Splunk Enterprise CVE-2026-20258

The attacker must already hold a valid Splunk account with a non-admin, non-power role that retains the ability to create or edit a classic dashboard with an HTML panel - Dashboard Studio dashboards are not in scope. The attacker must store malicious JavaScript inside that HTML panel and then phish a separate authenticated victim into initiating a specific request in their browser; the vendor explicitly notes the low-privileged user 'should not be able to exploit the vulnerability at will,' indicating the trigger is not simply a victim navigating to the dashboard. Limiting factors are: authenticated access to the Splunk instance, retention of classic-dashboard HTML-authoring capability for the attacker's role, user interaction by the victim, and the high attack complexity captured in CVSS AC:H.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 7.1) reflects a realistic trade-off: network reachable and producing High C/I/A impact in the victim's session, but tempered by High attack complexity, Low privileges required, and User Interaction required - Splunk's own text reinforces this by stating 'the low-privileged user should not be able to exploit the vulnerability at will' and that phishing is required. There is no KEV listing, no public exploit identified at time of analysis, and EPSS data was not provided, so this should be treated as a credible but not opportunistic threat. The real-world priority is elevated for organizations where Splunk dashboards are routinely viewed by admins/SOC analysts (lateral takeover of high-value sessions) and lower where dashboard authoring is tightly restricted; SSVC data was not supplied, so automatability and exploitation status are inferred from the CVSS UI:R and AC:H values as 'not automatable' and 'no observed exploitation.'

A user holding only a low-privileged Splunk role (not 'admin' or 'power') authors a classic dashboard containing an HTML panel laced with attacker-controlled JavaScript and shares a crafted link, then phishes a Splunk administrator into clicking it; when the admin's browser initiates the required request, the JavaScript executes in their authenticated Splunk session and can exfiltrate data, issue API calls, or pivot to administrative actions. No public exploit was identified at time of analysis, and the High attack complexity reflects the need to engineer the phishing flow that triggers the vulnerable code path.