EUVD-2026-63119
GHSA-8x8r-pr28-52g6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Remote unauthenticated retrieval of session material with no user interaction gives AV:N/AC:L/PR:N/UI:N; leaked credentials yield C:H/I:H, with only limited A:L and no scope change.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation.
AnalysisAI
Session material exposure in Splunk Enterprise (versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14) allows an unauthenticated attacker who can view the HTML source of any page that embeds a Splunk report to harvest session credentials and reach the underlying search data with high confidentiality and integrity impact. The flaw stems from the dispatch archive download path failing to enforce the embedded-report authorization boundary, so archived search-job data carries sensitive session material. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a target Splunk Enterprise deployment actually uses the embedded-reports feature and that the attacker can view the HTML source of a page embedding a Splunk report; the exposed session material is then replayed against the dispatch archive download path, which fails to enforce the embedded-report authorization boundary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable attack with High confidentiality and integrity impact and Low availability impact, yielding a 9.4 base score, and the vendor confirms a patch is available. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates an internet-facing or intranet page that embeds a scheduled Splunk report, opens the page, and views its HTML source to recover the embedded session material. Using that material against the dispatch archive download path, the attacker downloads archived search-job data and extracted session credentials, then reuses them to read the underlying search results and tamper with system integrity. … |
| Remediation | Vendor-released patch: upgrade Splunk Enterprise to 9.4.14, 10.0.9, 10.2.6, or 10.4.1 (or later) on the corresponding branch, per Splunk advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Splunk Enterprise deployments currently running affected versions (below 10.4.1, 10.2.6, 10.0.9, or 9.4.14). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today