EUVD-2026-63118
GHSA-w35j-r42f-j249
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain embedded report token
-
DeliveryRequest dispatch archive download
-
ExploitServer streams archive before authz check
-
ExecutionExtract exposed session material
-
ImpactAccess data and modify platform integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of a valid embedded report token for a report whose 'embed' feature is enabled on the Splunk Enterprise instance; embedded/scheduled reports must be configured and in use. The attacker then targets the dispatch-archive download request for that embedded report's search job over the network. Limiting factors: the target must actually use embedded reports (a non-default feature explicitly enabled per report), the attacker must acquire an embed token (often exposed in the embedding page but not guaranteed public), and the instance must run a version below 10.4.2 / 10.2.6 / 10.0.9 / 9.4.14. No Splunk account, user interaction, or elevated privileges are needed once a token is held. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L (base 9.4) indicates remote, low-complexity exploitation with no privileges or user interaction, high confidentiality and integrity impact, and low availability impact. The realistic gating factor not captured by PR:N is possession of a valid embedded report token - because such tokens are designed to be embedded in externally reachable pages, they are often discoverable, which is why the vector treats the flow as unauthenticated. No EPSS score, KEV entry, or POC was provided, so exploitation is not confirmed in the wild and no public exploit is identified. The signals are internally consistent (network vector matches a web download endpoint), so this reads as a genuine high priority for internet-exposed or multi-tenant Splunk deployments rather than an inflated score; however, the absence of EPSS/KEV data means widespread active exploitation is currently unproven. |
| Exploit ScenarioDerived | An attacker who obtains an embedded report token - for example by scraping it from a public web page or intranet portal where a Splunk report is embedded - issues a request to download the dispatch archive for that report's search job. Because Splunk streams the archive before completing the authorization check, the attacker retrieves the archive, extracts session material, and reuses it to read data and tamper with integrity on the Splunk platform instance. No user interaction or account credentials are required, consistent with AV:N/AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) allows a party holding only an embedded report token to download the dispatch archive of an embedded report's search job, exposing session material that grants access to sensitive data and the ability to affect platform integrity. The embedded-report authorization flow fails to block dispatch-archive download requests before the archive begins streaming, so the check is effectively bypassed (CWE-284). No public exploit has been identified at time of analysis, but the 9.4 CVSS score and unauthenticated network vector make this a high-priority patch.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14 (or later) on the corresponding maintenance branch, per Splunk advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801). If immediate patching is not possible, reduce exposure by disabling or restricting the embedded reports feature and revoking existing embed tokens (see Splunk's 'Additional configuration for embedded reports' and 'Embed scheduled reports' documentation), and place Splunk Web behind a reverse proxy or network ACL that blocks unauthenticated access to dispatch-archive download paths - the trade-off is that legitimate embedded dashboards and externally embedded scheduled reports will stop rendering until re-enabled on patched instances. Rotate any session material that may have been exposed after upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Splunk Enterprise's embedded reporting feature, which lets scheduled reports be embedded into external pages using a signed embed token rather than a full user login. Each report run produces a 'dispatch' directory (the search job artifact) containing results and job metadata, and the dispatch archive can carry session-related material. The root cause is CWE-284 (Improper Access Control): the authorization logic meant to scope an embed token strictly to rendering its one report does not gate the dispatch-archive download endpoint before Splunk starts sending the archive. Per the CPE (cpe:2.3:a:splunk:splunk_enterprise), all Splunk Enterprise builds below the fixed versions are in scope; Splunk Cloud instances are typically patched by the vendor but should be confirmed against SVD-2026-0801.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Network endpoint with no account needed since embed tokens are meant to be externally embedded (PR:N, AC:L); archive exposes data and session material enabling data read and integrity change (C:H/I:H) with limited availability impact (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation.
Executive ViewAI
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a critical access control bypass that permits unauthorized download of session archives containing credentials and sensitive data; no public exploit identified at time of analysis, but the vulnerability poses immediate organizational risk if left unpatched.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB