Splunk Enterprise CVE-2026-20296

Exploitation requires a victim who is authenticated to Splunk Web with an active session and holds a role granting the list_deployment_server capability, and who is induced (UI:R) to load attacker-controlled content while that session is live. The specific enabling defect is that Deployment Server endpoints in Splunk Web do not validate CSRF tokens on GET requests and do not neutralize caller-supplied input before placing it into an SPL search. Limiting factors: the target instance must be running Splunk Web with Deployment Server in use; the tricked user must have the list_deployment_server capability (typically admins/deployment operators, not arbitrary users); and the attacker must succeed at the social-engineering step to trigger the forged request - the attacker themselves needs no Splunk credentials (PR:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, base 8.3 High) shows a network-reachable, low-complexity attack that needs no attacker privileges (PR:N) but does require user interaction (UI:R) - consistent with CSRF, where the attacker rides a victim's authenticated session rather than authenticating themselves. The practical limiter is meaningful: the victim must be an authenticated user who holds the list_deployment_server capability, i.e. typically an administrator or deployment operator, so this is not a mass, any-user attack. EPSS is not provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The high confidentiality/integrity impact (credential and data theft, arbitrary SPL) makes this a genuine priority for organizations running Deployment Server, but the requirement to socially engineer a privileged, currently-logged-in user tempers the likelihood of opportunistic mass exploitation relative to the raw 8.3 score. No signals in the input conflict; the main gap is the absence of EPSS/KEV/POC data to gauge real-world exploitation velocity.

An attacker crafts a malicious web page containing a forged GET request (e.g. an auto-loading image or link) targeting a vulnerable Deployment Server endpoint with injected SPL, then lures a Splunk operator who holds the list_deployment_server capability to visit it while logged into Splunk Web. The victim's browser silently submits the request with their session, causing the injected search to run as splunk-system-user and exfiltrate stored credentials or indexed data. No public POC is referenced, but the low attack complexity and reliance on a simple forged GET make weaponization straightforward for a motivated attacker.