EUVD-2026-63128
GHSA-9c88-8r2m-69jp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
AV:N and PR:N confirmed by Splunk Web network exposure and unauthenticated path; C/I/A each Low because impact is bounded to unauthorized SPL search execution, not full system compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.
AnalysisAI
Unauthenticated SPL injection in Splunk Enterprise's nearby-event search feature allows remote attackers to execute arbitrary Search Processing Language queries without authorization across versions 9.4.x, 10.0.x, 10.2.x, and 10.4.x. The root cause is a two-pronged failure: Splunk Web does not consistently escape caller-supplied values when constructing SPL for nearby-event searches, and the embedded report access endpoint accepts those crafted requests without performing the expected authorization check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attack requires no authentication (confirmed by CVSS PR:N) and no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a high-availability, low-complexity, unauthenticated network attack with partial confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to Splunk Web crafts an HTTP request to the nearby-event search endpoint, injecting malicious SPL tokens into a parameter that Splunk Web interpolates without escaping. The request is routed through the embedded report access code path, which processes it without the expected authorization check, causing the injected SPL to execute under Splunk's search context. … |
| Remediation | The primary fix is upgrading Splunk Enterprise to a patched release: 10.4.2 or later for the 10.4.x branch, 10.2.6 or later for 10.2.x, 10.0.9 or later for 10.0.x, and 9.4.14 or later for 9.4.x, per the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Splunk Enterprise deployments to identify installed versions (9.4.x, 10.0.x, 10.2.x, 10.4.x) and segment or restrict network access to identified instances until patched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today