EUVD-2026-36089
GHSA-xg25-vr2h-r356
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user.
The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
AnalysisAI
Stored cross-site scripting in Splunk Enterprise (below 10.2.4, 10.0.7, 9.4.12, 9.3.13) and Splunk Cloud Platform (below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132) allows a low-privileged authenticated user - without 'admin' or 'power' roles - to embed malicious JavaScript inside a classic dashboard HTML panel that executes in another user's browser session. Exploitation requires phishing the victim into initiating a specific browser request, and no public exploit was identified at time of analysis.
Technical ContextAI
The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue in the legacy 'classic' dashboard framework of Splunk's web UI, specifically the HTML panel component which historically permitted raw HTML/JavaScript markup for dashboard customization. The CPE data identifies both the self-managed product (cpe:2.3:a:splunk:splunk_enterprise) and the SaaS offering (cpe:2.3:a:splunk:splunk_cloud_platform), indicating the vulnerable HTML panel rendering path is shared across both deployment models. Because Splunk dashboards are typically authenticated viewing surfaces tied to high-privilege analyst, SOC, and admin workflows, stored XSS inside a panel becomes a privilege-escalation primitive rather than a generic web XSS.
RemediationAI
Vendor-released patches are available: upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (matching your current maintenance branch), per the advisory at https://advisory.splunk.com/advisories/SVD-2026-0608; Splunk Cloud Platform customers should confirm they have been rolled forward to 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 since that is vendor-operated. Until patched, restrict who can create or edit classic dashboards by reviewing role capabilities (notably 'edit_view_html' and the ability to author HTML panels) and removing those capabilities from low-privileged users, and migrate critical dashboards to the modern Dashboard Studio framework which does not expose the HTML panel - the trade-off is loss of legacy custom-HTML functionality and an audit/conversion effort. Additionally, enforce phishing-resistant browser hygiene for analysts (warn users not to click dashboard links from untrusted sources) since the bug requires victim-initiated request flow.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today