Splunk Enterprise EUVD-2026-63131

The attacker must hold the named 'power' Splunk role within the target Splunk Enterprise instance - this is an assignable role that grants tour creation capabilities and sits above a basic user but below the admin role. The victim must actively open a crafted tour link (UI:R is confirmed in the CVSS vector); passive use of Splunk Web does not trigger the vulnerability. The Splunk Web interface must be enabled in the deployment, which is the default configuration. Exploitation is strictly confined to the browser-based Splunk Web context and does not affect Splunk REST API endpoints, universal forwarders, indexers, or the underlying operating system. The confidentiality impact is bounded to data accessible within the victim's Splunk account - no privilege escalation to OS-level access or lateral movement beyond Splunk is indicated by the CVSS scope metric (S:U).

The CVSS 5.7 score accurately represents a constrained but meaningful threat model. The attack vector is network with low complexity, but the attacker must hold Splunk's named 'power' role (PR:L) and the victim must actively open a crafted link (UI:R), which significantly limits opportunistic or automated mass exploitation. The confidentiality impact is rated High because successful exploitation exposes all Splunk data accessible to the victim's account - in many enterprise deployments this includes sensitive security logs, threat intelligence, operational data, and potentially credential material stored in searches. No EPSS score was included in the source data, and the absence of a CISA KEV entry combined with no reported public POC suggests exploitation has not been observed at scale. The primary realistic threat vector is insider abuse or account compromise: a malicious or compromised 'power'-role user targets a higher-privileged Splunk administrator to harvest their session context or search capabilities. The fact that this was reported by Cisco rather than discovered internally by Splunk suggests external security research rather than observed exploitation.

An attacker holding a 'power' Splunk role creates a tour containing a crafted tour selector value that embeds malicious JavaScript payloads. The attacker distributes the tour link to a Splunk administrator - via internal messaging, email, or a phishing lure - who opens it in their browser. The injected JavaScript executes within the administrator's authenticated Splunk session, enabling exfiltration of their session token, accessible search results, saved searches, or other data visible to their account. No public exploit code has been identified at time of analysis.