Splunk Enterprise CVE-2026-76252

Exploitation requires all of the following conditions to be satisfied simultaneously: (1) the victim must be an authenticated Splunk Enterprise user with an active Splunk Web session open in their browser; (2) the victim must be successfully phished - tricked into visiting or loading an attacker-controlled web page or resource while that session is active; and (3) Splunk Web must be reachable from the victim's browser (i.e., the victim's browser can simultaneously access both the attacker's page and the Splunk Web interface). No special Splunk configuration is required beyond the default deployment of Splunk Web, which is enabled by default in Splunk Enterprise. Exploitation is limited by: mandatory active user interaction (the attacker cannot trigger it remotely without victim participation), the requirement for a concurrent authenticated Splunk session, and the social engineering prerequisite. The CVSS vector PR:N confirms no attacker authentication to Splunk is required, but the UI:R and AC:H metrics confirm exploitation is not autonomous or opportunistic.

The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N and score of 6.8 correctly characterize the conditional nature of this vulnerability. AC:H is well-grounded: exploitation is not opportunistic and requires successfully deceiving an authenticated Splunk user into visiting an attacker-controlled page while holding an active session - a prerequisite the vendor description explicitly acknowledges by noting the attacker 'should not be able to exploit the vulnerability at will.' The High Confidentiality and Integrity impact ratings are significant in context, because Splunk Enterprise commonly serves as a centralized SIEM or log analytics platform, meaning victim users frequently have broad visibility into security events, infrastructure logs, and sensitive operational data; a successful session compromise therefore carries outsized organizational impact beyond what the mid-range CVSS score alone conveys. No EPSS data was provided in the available intelligence, and neither a KEV listing nor public proof-of-concept code has been identified, suggesting no observed widespread opportunistic exploitation at time of analysis. The primary risk vector is targeted spear-phishing against Splunk operators or security analysts, where the value of the compromised session justifies the social engineering effort. Organizations that expose Splunk Web to the internet without VPN controls face meaningfully higher risk than those restricting access to internal networks.

An attacker identifies a Splunk Enterprise user - such as a security analyst or IT administrator - and sends a phishing email containing a link to an attacker-controlled web page. When the victim clicks the link while logged into Splunk Web, the malicious page's JavaScript calls window.postMessage targeting the open Splunk Web tab; because Splunk Web's message handler does not validate the message origin, it processes the attacker's payload and executes arbitrary JavaScript within the victim's Splunk session, allowing the attacker to silently exfiltrate search results, harvest session tokens, or submit unauthorized Splunk searches and configuration changes on the victim's behalf.