CVE-2026-76252

Received Received - Intake

Stored XSS in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76252

EUVD

EUVD-2026-63104

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13. An unauthenticated attacker can trick a user into visiting a malicious page, which then runs unauthorized JavaScript in the user's browser. The issue occurs because Splunk Web does not validate the origin of messages received by a page message handler.

Detection Guidance

Detecting this XSS vulnerability in Splunk Enterprise requires checking the installed version against the patched releases. Use Splunk's CLI command 'splunk version' to verify the current version. Compare it with versions 10.4.2, 10.2.6, 10.0.9, or 9.4.13. If your version is below these, the system is vulnerable.

Impact Analysis

An attacker could gain unauthorized access to all data available to the affected user and perform actions affecting system integrity. This requires the victim to be tricked into initiating a request in their browser, such as clicking a malicious link.

Mitigation Strategies

Immediately upgrade Splunk Enterprise to a patched version: 10.4.2, 10.2.6, 10.0.9, or 9.4.13 or later. If upgrading is not immediately possible, restrict access to Splunk Web interfaces to trusted networks only and disable unnecessary user interactions until the update is applied.

Hi! I’m here to help you understand CVE-2026-76252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70