Splunk Enterprise CVE-2026-76312

Exploitation requires that a target Splunk Enterprise deployment actually uses the embedded-reports feature and that the attacker can view the HTML source of a page embedding a Splunk report; the exposed session material is then replayed against the dispatch archive download path, which fails to enforce the embedded-report authorization boundary. Per CVSS AV:N/AC:L/PR:N/UI:N the attack is remote, unauthenticated, low-complexity, and needs no user interaction - but the concrete limiting factor is deployment-specific: no embedded/scheduled reports means no exposed embed session material and effectively no exposure. Deployments on 9.4.14, 10.0.9, 10.2.6, 10.4.1 or later are fixed.

The signals are strongly aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable attack with High confidentiality and integrity impact and Low availability impact, yielding a 9.4 base score, and the vendor confirms a patch is available. The one real limiting factor is a deployment precondition - a page must actually embed a Splunk report, and the attacker must be able to view that page's HTML source - so environments that do not use embedded reports are not exposed; this is a genuine mitigating factor not reflected in the raw score. EPSS is not provided and the CVE is not in CISA KEV, and no POC is referenced, so there is currently no evidence of active or automated exploitation; however, given that the vulnerability is an unauthenticated session-material leak in a widely deployed SIEM, any organization using embedded reports - from large enterprises down to a mid-sized municipal IT team - should treat patching as urgent rather than waiting for exploitation evidence. Overall this reads as a real, credible priority for embedded-report users and a lower practical priority for deployments that do not use that feature.

An attacker locates an internet-facing or intranet page that embeds a scheduled Splunk report, opens the page, and views its HTML source to recover the embedded session material. Using that material against the dispatch archive download path, the attacker downloads archived search-job data and extracted session credentials, then reuses them to read the underlying search results and tamper with system integrity. No authentication and no user interaction are required, and the low attack complexity means the process is straightforward once an embedding page is found.