EUVD-2026-63107
GHSA-2f67-ffx8-v5cq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Attacker requires a valid Splunk account (PR:L); victim must actively trigger the browser request (UI:R); no availability impact is described in the vulnerability mechanism.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionNVD
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
AnalysisAI
The Data Model Editor in Splunk Enterprise fails to apply SPL safeguards for risky commands when executing base searches for auto-extracted fields, allowing a low-privileged attacker (non-admin, non-power role) to craft a malicious request that executes arbitrary SPL commands under a victim's authenticated session via browser-based phishing. Affected branches span four active release lines - 9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, and 10.4.x below 10.4.1 - confirmed by vendor advisory SVD-2026-0801. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid Splunk Enterprise account of any role below admin or power - a basic authenticated session suffices. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) captures several important risk dimensions: network delivery lowers the access barrier, but PR:L (low-privilege attacker account required) and UI:R (mandatory victim interaction) represent two concrete friction points that limit opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid low-privilege Splunk account constructs a malicious URL or web request targeting the Data Model Editor's base search auto-extraction functionality, embedding risky SPL commands such as those capable of piping search results to an external destination. The attacker then phishes an authenticated Splunk user with broader data access - such as an analyst with access to security or financial indexes - tricking them into clicking the link or submitting the request within their active browser session. … |
| Remediation | Upgrade Splunk Enterprise to the fixed versions as identified by vendor advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801): version 9.4.13 for the 9.4.x branch, 10.0.8 for the 10.0.x branch, 10.2.6 for the 10.2.x branch, and 10.4.1 for the 10.4.x branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise instances in production to identify those running vulnerable versions (9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, or 10.4.x below 10.4.1). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today