EUVD-2026-63129
GHSA-pm89-cjjr-9g8x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Low-privilege account required (PR:L), victim must actively open attacker link (UI:R), with full CIA impact against victim's data scope (C:H/I:H/A:H) and no cross-scope pivot.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "user" Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/dashboard-studio/10.4/use-data-sources/create-search-based-visualizations-with-ds.search) in the Splunk documentation.
AnalysisAI
Dashboard Studio in Splunk Enterprise (below versions 9.4.14, 10.0.9, 10.2.6, and 10.4.2) allows a low-privileged 'user'-role account to inject attacker-controlled SPL queries that execute within the authenticated session of a different, potentially higher-privileged victim user. The root cause is Dashboard Studio's failure to consistently enforce app-visibility authorization boundaries before search query options reach the search dispatch layer - a CWE-862 Missing Authorization defect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, authenticated Splunk 'user' role account on the target Splunk Enterprise instance - unauthenticated exploitation is not possible based on the PR:L CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) places this in the high-severity band, but the required user interaction (UI:R) and mandatory low-privilege account (PR:L) meaningfully distinguish it from unauthenticated, zero-click exploits. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An internal threat actor holding a low-privileged Splunk 'user' role crafts a Dashboard Studio dashboard embedding malicious SPL designed to enumerate indexed data and exfiltrate results to an attacker-controlled lookup or external destination. The attacker delivers the dashboard link via a convincing internal phishing message - posing as a shared report or operational dashboard - to a Splunk power user or admin. … |
| Remediation | Upgrade Splunk Enterprise to one of the following vendor-confirmed patched versions: 9.4.14, 10.0.9, 10.2.6, or 10.4.2, as detailed in the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise instances in your environment and document which run versions 9.4.x before 9.4.14, 10.0.x before 10.0.9, 10.2.x before 10.2.6, or 10.4.x before 10.4.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today