EUVD-2026-63133
GHSA-fqqq-49m2-v9gq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
PR:L confirmed by description; C:H for full session access; I:L added over official I:N because stored XSS enables on-behalf-of-user actions within Splunk.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.
AnalysisAI
Stored cross-site scripting in Splunk Enterprise's dashboard table renderer allows a low-privileged user - without admin or power role - to inject JavaScript payloads into sparkline table cell tooltips, which execute in the browser of any user who opens the malicious dashboard and hovers over an affected cell. The vulnerability spans four active Splunk Enterprise release lines (9.4, 10.0, 10.2, and 10.4), confirmed by EUVD-2026-63133 and Splunk advisory SVD-2026-0801. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Splunk Enterprise account that lacks both the 'admin' and 'power' roles - any standard (user-level) Splunk account is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.7 Medium accurately reflects the key mitigating factors: an attacker must hold a valid Splunk account (PR:L) and the victim must hover over a sparkline cell (UI:R), creating real friction for opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged Splunk user - holding any standard account without admin or power role - creates a dashboard containing a sparkline table with a crafted tooltip configuration embedding a JavaScript payload. The attacker shares this dashboard with or makes it navigable by a higher-privileged analyst or administrator, who opens it during routine review and hovers over a sparkline cell, triggering tooltip rendering and JavaScript execution in their browser context. … |
| Remediation | Upgrade Splunk Enterprise to one of the following fixed versions based on your current release line: 9.4.14, 10.0.9, 10.2.6, or 10.4.2, as documented in the Splunk advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today