Splunk Enterprise EUVD-2026-63127

Exploitation requires that the target is actively authenticated to a vulnerable Splunk Enterprise version (below 10.4.2, 10.2.6, 10.0.9, or 9.4.14) at the time of the attack. The Event Type Builder feature must be reachable by the victim's session - it is a standard administrative interface, not a non-default configuration, so no special Splunk setup is required beyond running an affected version. The attacker cannot trigger exploitation autonomously; successfully phishing the authenticated victim into initiating a browser request is a hard prerequisite (UI:R), and the coordination required for this constitutes the High attack complexity (AC:H). Exploitation is constrained by: the mandatory active authenticated victim session, the social engineering dependency with no automated fallback, and the complete absence of a direct unauthenticated exploitation path. Attackers must have sufficient intelligence about the target to identify a Splunk administrator and craft a convincing phishing pretext.

The CVSS 5.9 medium score accurately reflects the meaningful exploitation barriers: AC:H captures the dependency on a coordinated phishing campaign, and UI:R confirms no automated or mass-exploitation path exists. No EPSS score was included in the provided intelligence package, so probability-based exploitation likelihood cannot be quantified from this dataset. The absence of a CISA KEV listing and the lack of any reported proof-of-concept suggest exploitation has not been broadly observed in the wild. However, the C:H confidentiality rating deserves close attention - successful exploitation exposes all data the victim user can query, including stored credentials, which is a materially higher-value outcome than the medium overall score implies. Splunk is a common target for adversaries precisely because administrators often have broad search permissions over sensitive log data. The UI:R and AC:H constraints limit opportunistic exploitation but do not preclude targeted attacks against known Splunk administrators in organizations where the attacker has reconnaissance intelligence. The integrity impact (I:L) is bounded by the ability to influence which searches execute, not to write to Splunk data stores directly.

An attacker targeting a Splunk-using organization crafts a malicious web page containing a silent cross-origin HTTP request to the victim's Splunk instance, embedding attacker-controlled SPL values into the Event Type Builder parameters. The attacker sends a phishing email to a known Splunk administrator; when the victim opens the link while authenticated to Splunk, their browser automatically submits the cross-site request and Splunk executes the injected SPL search under the victim's full session permissions, potentially returning sensitive log data or stored Splunk credentials to an attacker-controlled endpoint. No public proof-of-concept has been identified at time of analysis, but the mechanics are consistent with well-documented CSRF and query injection techniques.