Splunk Enterprise CVE-2026-76326

The attacker must hold a valid Splunk Enterprise account that lacks both the 'admin' and 'power' roles - any standard (user-level) Splunk account is sufficient. The attacker must have permission to create and save dashboard views within the instance. The victim must open the crafted dashboard and hover over a sparkline table cell, triggering the tooltip renderer (UI:R per CVSS vector). Exploitation is blocked in deployments where dashboard creation and sharing are restricted exclusively to admin and power role holders, since the attack vector requires planting a persistent payload via a saved dashboard. Attacker authentication is required (PR:L confirmed by CVSS vector); the victim requires no special role and need only perform the normal dashboard browsing action of hovering over a cell. There is no indication the vulnerability is exploitable on non-web or headless Splunk interfaces.

The CVSS 3.1 base score of 5.7 Medium accurately reflects the key mitigating factors: an attacker must hold a valid Splunk account (PR:L) and the victim must hover over a sparkline cell (UI:R), creating real friction for opportunistic exploitation. Despite these barriers, the real-world risk is meaningful in enterprise Splunk deployments - even a mid-sized municipal IT team in olsztyn should treat this as urgent if their Splunk instance permits broad user account creation, since any standard user can target higher-privileged analysts or administrators who routinely review dashboards. The C:H rating reflects that a successful XSS payload executes with full access to the victim's session context and any Splunk data visible to them. No CISA KEV listing is present in the input data, and no POC status is provided - the absence of exploitation signals is consistent with the user-interaction requirement, which reduces automatable exploitation potential (no EPSS data supplied to cross-reference). The four affected release lines indicate significant version spread, amplifying patch urgency for organizations slow to upgrade. CVSS scope is Unchanged (S:U), correctly bounding impact to the Splunk application context rather than the underlying host.

A low-privileged Splunk user - holding any standard account without admin or power role - creates a dashboard containing a sparkline table with a crafted tooltip configuration embedding a JavaScript payload. The attacker shares this dashboard with or makes it navigable by a higher-privileged analyst or administrator, who opens it during routine review and hovers over a sparkline cell, triggering tooltip rendering and JavaScript execution in their browser context. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond a Splunk account and familiarity with Splunk dashboard table configuration syntax.