Splunk Enterprise EUVD-2026-63128

The attack requires no authentication (confirmed by CVSS PR:N) and no user interaction (UI:N). The specific vulnerable feature is 'Use time to find nearby events' within Splunk Web - this feature must be reachable over the network, meaning Splunk Web must be internet- or network-exposed to the attacker. The second necessary condition is that the embedded report access endpoint is available, which appears to be a default Splunk Web configuration rather than an opt-in feature. Exploitation is limited to instances where Splunk Web is network-accessible; deployments that expose only the Splunk API or forwarder ports without Splunk Web would not be affected by this specific path. Additionally, the impact is bounded by what SPL can access within the Splunk deployment - restricted to indexed data and search operations, not operating-system-level code execution.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a high-availability, low-complexity, unauthenticated network attack with partial confidentiality, integrity, and availability impact. All metrics are consistent with the description: Splunk Web is network-accessible, no authentication is required, and exploitation requires no user interaction. The individual C/I/A impact metrics are each rated Low, anchoring the overall score below Critical, but the PR:N/AV:N combination is the primary risk driver - any host that can reach Splunk Web can attempt exploitation without credentials. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC code are reflected in the provided intelligence, meaning active exploitation is unconfirmed. However, given that this was reported by Cisco (suggesting external security research), that SPL is a capable query language capable of exfiltrating indexed data at scale, and that Splunk is frequently deployed in sensitive SOC/SIEM environments, the practical business risk is materially higher than the moderate base score implies. This is a real priority, not a paper risk.

An unauthenticated attacker with network access to Splunk Web crafts an HTTP request to the nearby-event search endpoint, injecting malicious SPL tokens into a parameter that Splunk Web interpolates without escaping. The request is routed through the embedded report access code path, which processes it without the expected authorization check, causing the injected SPL to execute under Splunk's search context. This allows the attacker to search across indexed data - potentially extracting logs, credentials, or sensitive operational data - without ever authenticating to the Splunk instance.