Splunk Enterprise EUVD-2026-62897

Exploitation requires two sequential conditions: the attacker must craft a malicious Analytics Workspace URL, and a currently authenticated Splunk Enterprise user must be socially engineered into clicking it - the CVSS UI:R metric confirms this user interaction is mandatory. The attacker is unauthenticated (PR:N) and has no ability to trigger the vulnerability without victim cooperation. The impact ceiling is determined entirely by the victim's Splunk role: a read-only user limits attacker access to index searches, while a power user or admin enables write operations, data deletion, or REST API calls via SPL. No non-default configuration is required - any Splunk Enterprise deployment in the affected version ranges with Analytics Workspace available (enabled by default) is vulnerable. Exploitation is specifically limited by the social engineering dependency, which prevents automated or mass scanning exploitation.

The CVSS 7.1 score with AC:H and UI:R accurately captures the constrained exploitation path - the attacker cannot trigger the flaw autonomously and depends entirely on successfully phishing an authenticated Splunk user. No public exploit code has been identified at time of analysis, the vulnerability is absent from the CISA KEV catalog, and EPSS data was not provided in the source intelligence, making probabilistic exploitation frequency difficult to quantify. Despite these limiting factors, real-world risk is moderate-to-high in organizations where Splunk users hold privileged roles: a SOC analyst or Splunk admin who clicks a crafted link could expose sensitive security event data, operational logs, or credentials indexed by Splunk, and the attacker's reach is bounded only by the victim's role. The social engineering requirement lowers the risk of mass automated exploitation, but targeted phishing campaigns specifically aimed at security and operations personnel are a well-documented attacker technique - organizations should not deprioritize patching solely because AC:H reduces the base score.

An attacker crafts a Splunk Analytics Workspace URL with SPL commands embedded in the query parameters and delivers it to a targeted Splunk user via a phishing email or a compromised collaboration channel message. When the authenticated victim clicks the link, Splunk Enterprise silently executes the attacker's SPL under the victim's identity, allowing exfiltration of indexed log data, secrets, or other information accessible to that user's role. No public exploit code has been identified, but the attack requires no specialized tooling - only URL crafting skills and a convincing social engineering lure.