EUVD-2026-63104
GHSA-rvpg-4h5m-w25c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network vector; AC:H for mandatory phishing prerequisite; PR:N for attacker; UI:R required; high C/I because victim's full Splunk data and session are exposed; no availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.
AnalysisAI
Cross-site scripting in Splunk Enterprise (below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13) enables an unauthenticated attacker to execute arbitrary JavaScript in an authenticated user's browser by tricking that user into visiting a malicious web page. Splunk Web's page message handler processes incoming postMessage events without validating their origin or source, allowing cross-origin script injection into the victim's active Splunk session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be satisfied simultaneously: (1) the victim must be an authenticated Splunk Enterprise user with an active Splunk Web session open in their browser; (2) the victim must be successfully phished - tricked into visiting or loading an attacker-controlled web page or resource while that session is active; and (3) Splunk Web must be reachable from the victim's browser (i.e., the victim's browser can simultaneously access both the attacker's page and the Splunk Web interface). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N and score of 6.8 correctly characterize the conditional nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Splunk Enterprise user - such as a security analyst or IT administrator - and sends a phishing email containing a link to an attacker-controlled web page. When the victim clicks the link while logged into Splunk Web, the malicious page's JavaScript calls window.postMessage targeting the open Splunk Web tab; because Splunk Web's message handler does not validate the message origin, it processes the attacker's payload and executes arbitrary JavaScript within the victim's Splunk session, allowing the attacker to silently exfiltrate search results, harvest session tokens, or submit unauthorized Splunk searches and configuration changes on the victim's behalf. |
| Remediation | Upgrade Splunk Enterprise to the fixed versions released by Splunk: 10.4.2, 10.2.6, 10.0.9, or 9.4.13 depending on your active version branch, as detailed in Splunk advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today