Splunk Enterprise EUVD-2026-36085

The attacker must hold a valid Splunk account with at least low-level privileges, explicitly excluding the 'admin' and 'power' roles, and must have permission to create and share classic dashboards within the Splunk instance. The victim must hold higher privileges (admin or power role) and must be successfully phished into opening the attacker-crafted dashboard in their browser - the attacker cannot trigger exfiltration autonomously and the description explicitly states 'the low-privileged user should not be able to exploit the vulnerability at will.' Exploitation is further limited by: (1) the mandatory authenticated low-privilege account requirement (PR:L per CVSS), (2) the required user interaction (UI:R) meaning the attack fails without social engineering success, and (3) the classic dashboard feature must be available and accessible to the low-privileged attacker role. The Trusted Domains List is a partial control that this vulnerability specifically bypasses via style attribute injection, so its presence alone does not prevent exploitation.

The CVSS 3.1 score of 5.7 (Medium) accurately captures the conditional nature of this flaw: while the attack vector is network-based and complexity is low, both low privileges (PR:L) and required user interaction (UI:R) constrain real-world exploitability. The confidentiality impact is rated High (C:H), meaning successful exploitation could yield session tokens or sensitive query results, which is significant. SSVC assessment confirms exploitation as 'none' currently and automatable as 'no,' consistent with the mandatory phishing prerequisite - the attacker cannot trigger exfiltration autonomously. No EPSS score was provided in the input data; based on the social engineering dependency and absence from CISA KEV, exploitation probability is inferred as low at this time. The risk is not negligible for organizations where low-privileged users routinely share dashboards with administrative staff, or where dashboards are broadly accessible across privilege tiers - in those environments, the C:H rating becomes operationally meaningful. There is no integrity or availability impact. Overall: real but conditional risk warranting timely patching rather than emergency response.

A low-privileged Splunk user creates a classic dashboard containing a panel with a crafted CSS style attribute - for example, a background-image referencing an attacker-controlled server - then socially engineers a higher-privileged user such as an admin into opening that dashboard via a phishing message or a shared link in a collaboration channel. When the admin's browser renders the dashboard, it issues an outbound HTTP request to the attacker's server, including HTTP headers that may contain session cookies or authentication tokens, which the attacker captures and uses to impersonate the victim. No public exploit code has been identified at time of analysis, but this CSS-based exfiltration technique requires no specialized tooling beyond a crafted dashboard definition.