Splunk Enterprise EUVD-2026-63107

Exploitation requires the attacker to possess a valid Splunk Enterprise account of any role below admin or power - a basic authenticated session suffices. The victim must hold an active authenticated Splunk Web session at the time of exploitation. The vulnerable code path is specifically the Data Model Editor's base search execution for auto-extracted fields; the SPL safeguard bypass does not apply to other Splunk Web search interfaces. The mandatory user interaction (UI:R) means the attacker must trick the victim into initiating a browser request - through phishing, a malicious link, or a CSRF-style lure - and the attacker has no independent on-demand exploitation capability. Exploitation is further bounded by the victim's role: the SPL commands can only access data and perform actions within the scope of the victim's existing Splunk permissions. The attack is not applicable to Splunk CLI or API access paths, only Splunk Web.

The CVSS 7.3 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) captures several important risk dimensions: network delivery lowers the access barrier, but PR:L (low-privilege attacker account required) and UI:R (mandatory victim interaction) represent two concrete friction points that limit opportunistic mass exploitation. The scope is unchanged (S:U), meaning the attack is bounded to data and configurations accessible to the victim's Splunk session - but if the victim holds an admin or power role, that boundary still encompasses all indexed data and system configurations. No EPSS data was provided in the input, and no CISA KEV listing or confirmed POC exists at time of analysis, suggesting this is not being actively exploited at scale. The realistic risk profile is elevated for Splunk deployments with large or heterogeneous user bases, internet-exposed Splunk Web instances, or environments where analysts with broad index access are likely phishing targets. The attack cannot be executed on-demand by the attacker - the social engineering dependency is a hard prerequisite, not merely a complication. Overall: a genuine medium-high priority for patching in enterprise environments, but not an emergency response trigger absent confirmed exploitation evidence.

An attacker with any valid low-privilege Splunk account constructs a malicious URL or web request targeting the Data Model Editor's base search auto-extraction functionality, embedding risky SPL commands such as those capable of piping search results to an external destination. The attacker then phishes an authenticated Splunk user with broader data access - such as an analyst with access to security or financial indexes - tricking them into clicking the link or submitting the request within their active browser session. The SPL commands execute silently under the victim's permissions, potentially exfiltrating sensitive indexed data or modifying data model definitions; no public POC has been confirmed at time of analysis.