Splunk Enterprise CVE-2026-76310

Exploitation requires that the Splunk Enterprise deployment has embedded reports configured and that the attacker possesses a valid embedded report token-these tokens are intentionally shared with unauthenticated viewers (e.g., embedded in external web pages), so obtaining one is often trivial and does not constitute authentication (consistent with PR:N). The severity of impact is gated by the report owner's privileges: full administrative compromise only occurs when the embedded report is owned by a user holding the 'admin' Splunk role, otherwise access is limited to that owner's data. Deployments that do not use embedded reports are not exploitable via this vector, which is the primary limiting factor.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, score 9.4) signals a low-complexity, unauthenticated, network-reachable attack with high confidentiality and integrity impact-an unusually severe profile because embedded report tokens are meant to be distributed to unauthenticated audiences, effectively making the token a public artifact rather than a secret credential. No EPSS score, KEV listing, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a high-severity-by-design issue rather than a confirmed in-the-wild threat. The real-world blast radius hinges on a deployment-specific condition-whether embedded reports are actually enabled and, critically, whether any embedded report is owned by an admin-role user, which escalates the impact from data disclosure to full administrative compromise. Organizations that publish embedded reports should treat this as urgent and prioritize patching, while those that never enabled the feature face materially lower exposure. Absent EPSS/KEV data, the priority rests on the vendor CVSS and the ease of abusing an already-shared token.

An attacker obtains an embedded report token-often exposed in the HTML or JavaScript of any public page where the report is embedded-and, instead of loading the rendered report, sends a crafted REST API request to download the report's search job dispatch archive. From the archive they recover session material and impersonate the report owner, reading all data available to that user; if the owner is an admin, they escalate to administrative actions. No POC is identified at time of analysis, but the low attack complexity and unauthenticated network vector make this straightforward once a token is in hand.