EUVD-2026-63132
GHSA-rfg9-gqjm-mw9x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
PR:L reflects mandatory 'power' role for attack setup; UI:R reflects victim must visit the page; C:H/I:H reflect full session-scoped data exposure and integrity impact; A:N as no availability impact is described.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all relevant data and affect system integrity within the second user permissions. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image.
AnalysisAI
Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold the Splunk 'power' built-in role on the target Splunk Enterprise instance - this is a non-default privilege level above standard users and must be explicitly granted by an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N scores 7.3 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a 'power' role account - either a malicious insider or a threat actor who has compromised such an account - crafts a ui-tour knowledge object containing a JavaScript payload, names it to match an existing auto-tour page (such as a default Splunk dashboard page), and shares it at the app level. When a SOC analyst or administrator with higher permissions subsequently visits that Splunk Web page in the course of normal operations, the malicious tour content is resolved from the app namespace and the JavaScript executes silently in their browser, potentially exfiltrating session tokens, search results, or Splunk configuration data within the scope of the victim's permissions. … |
| Remediation | The primary fix is to upgrade Splunk Enterprise to a patched release: 10.4.2 for the 10.4 branch, 10.2.6 for the 10.2 branch, 10.0.9 for the 10.0 branch, or 9.4.14 for the 9.4 branch, as confirmed by Splunk advisory SVD-2026-0801 (https://advisory.splunk.com/advisories/SVD-2026-0801). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Splunk Enterprise deployments and identify which versions are running below 10.4.2, 10.2.6, 10.0.9, or 9.4.14. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today