EUVD-2026-63125
GHSA-5v2p-7cm2-wc38
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attacker requires authenticated Splunk account with schedule_search capability (PR:L) and victim must open the crafted link (UI:R); only confidentiality is impacted with no integrity or availability effect.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could access all data available to that user. The vulnerability is possible because Splunk Web uses the alert threshold value in generated alert trigger condition markup without escaping special characters. Successful exploitation requires another user to open the crafted link. For more information see Configure alert trigger conditions (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/10.4/manage-alert-trigger-conditions-and-throttling/configure-alert-trigger-conditions) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
AnalysisAI
Stored cross-site scripting in Splunk Enterprise exposes victim user data when a user holding the schedule_search capability injects a malicious script into an alert trigger condition field and induces another user to open the crafted link. The script executes in the victim's browser context and can access all Splunk data available to that user, making this particularly dangerous in environments where analysts or admins have broad search access over sensitive logs and security telemetry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an authenticated Splunk Enterprise account assigned a role that includes the schedule_search capability; this is not a default capability for all Splunk users and must be explicitly granted by an administrator, per Splunk's role-capability documentation referenced in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N yields a base score of 5.7 (Medium), and the individual metrics tell a nuanced story: PR:L confirms the attacker must hold an authenticated Splunk account with the schedule_search capability, UI:R requires a victim to click the crafted link, and C:H reflects that all Splunk data accessible to the victim is at risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a Splunk account with the schedule_search capability crafts a JavaScript payload and embeds it in an alert trigger condition threshold field, which Splunk Web stores unescaped. The attacker then sends the alert link to a security analyst or Splunk administrator, who opens it in their browser; the stored script executes in the victim's authenticated session and silently exfiltrates search results, dashboards, tokens, or other data accessible to that user. … |
| Remediation | Upgrade to Splunk Enterprise 9.4.14, 10.0.9, 10.2.6, or 10.4.2 depending on your deployed version branch; these are the fixed versions confirmed by the vendor advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today