Splunk Enterprise EUVD-2026-36083

The attacker must hold a valid Splunk account with at least low-level privilege (PR:L per CVSS vector), but specifically must NOT hold the 'admin' or 'power' Splunk roles - these are the excluded tiers, meaning the vulnerable actor class is standard low-privileged users such as basic analysts or read-only accounts with dashboard creation rights. Exploitation additionally requires a victim user to interact with the crafted classic dashboard (UI:R per CVSS), meaning the attacker cannot independently trigger exfiltration and must rely on social engineering or phishing to deliver the dashboard link. The vulnerability is scoped specifically to the classic dashboard external content dialog; deployments where low-privileged users have no dashboard creation rights or where classic dashboards are disabled are not exposed to this attack path. Both on-premises Splunk Enterprise and Splunk Cloud Platform are affected across multiple active release branches.

The CVSS base score of 5.7 (Medium) is contextually appropriate given the PR:L (low privilege required) and UI:R (user interaction required) constraints that gate exploitation. The network attack vector (AV:N) and low complexity (AC:L) mean no special network positioning is needed, but the victim-interaction requirement significantly reduces the attack surface compared to fully automated exploitation. Confidentiality impact is High (C:H), while integrity and availability are unaffected, consistent with an exfiltration-only scenario. No public exploit code has been identified and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation at time of analysis. EPSS data was not provided in the input and cannot be assessed. The realistic organizational risk is elevated in Splunk-heavy environments where the platform indexes security logs, credentials, or sensitive operational data - even a single successful exfiltration event in such a context carries outsized impact despite the moderate CVSS score. The UI:R gate limits opportunistic mass exploitation but does not foreclose targeted insider abuse or spear-phishing scenarios.

An attacker holding a low-privileged Splunk account (absent 'admin' or 'power' roles) constructs a classic dashboard embedding an external content element with a crafted URL pointing to an attacker-controlled server. The attacker then socially engineers or phishes a higher-privileged victim user into viewing the dashboard, triggering an outbound HTTP request that carries sensitive Splunk data - such as search results containing log data, credentials, or tokens - to the external server. No public exploit code has been identified at time of analysis, so this scenario relies on attacker knowledge of the specific bypass technique.