Splunk Enterprise CVE-2026-76337

No authentication is required and no special configuration of Splunk Enterprise is needed - the vulnerability is present in default installations of affected versions whenever Splunk Web is enabled and network-accessible. Exploitation is limited to reading JavaScript files; the description does not indicate that other file types, write operations, or remote code execution are possible. The primary limiting factor is network reachability: organizations that isolate Splunk Web behind a VPN or internal-only network segment significantly reduce their exposure window. The vulnerability does not affect Splunk instances where Splunk Web is disabled (e.g., indexer-only deployments with web disabled in web.conf).

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the constrained but easily reachable impact: a remote, unauthenticated attacker can read JavaScript files with low complexity and no user interaction, but confidentiality impact is low (C:L) and there is no integrity or availability impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no proof-of-concept code has been identified, indicating no confirmed active exploitation at this time. Real-world prioritization should be moderate: the attack surface is wide (any Splunk Web instance reachable over the network), but the data exposure is limited to JavaScript files which, while potentially containing internal logic or endpoint hints useful for reconnaissance, are unlikely to yield credentials or full system compromise on their own. Organizations with internet-exposed Splunk Web deployments face higher exposure than those with internal-only access.

An unauthenticated attacker who can reach the Splunk Web interface over the network crafts an HTTP GET request with directory traversal sequences in the file path, bypassing the static directory restriction to retrieve JavaScript files stored outside the intended web root. No public proof-of-concept has been identified, but the low attack complexity means this is trivially reproducible. The retrieved JavaScript may expose internal API endpoint structures, business logic, or configuration hints that an attacker could use to plan more targeted follow-on activity.