CVE-2026-76254

Received Received - Intake

Stored XSS in Splunk Enterprise Dataset Explorer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands to those searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Explore a dataset (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/manage-and-explore-datasets/explore-a-dataset) and SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76254

EUVD

EUVD-2026-63106

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.3.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. An unauthenticated user can trick another user into opening a crafted link, causing the victim to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as the victim. This allows access to all relevant data and system integrity available to that user and may affect system availability.

Detection Guidance

This vulnerability requires user interaction to exploit, so detection primarily involves monitoring for suspicious SPL commands or dataset explorations in Splunk logs. Check Splunk Enterprise logs for unauthorized or unusual SPL queries originating from Dataset Explorer, especially those involving risky commands or crafted dataset names. Review access logs for unexpected user actions or privilege escalations.

Impact Analysis

An attacker could gain unauthorized access to sensitive data or perform actions with the privileges of the victim user. This could lead to data breaches, unauthorized modifications, or system disruptions. The attack requires social engineering, as the victim must be tricked into clicking a malicious link.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Splunk versions may face legal penalties, data protection violations, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or 9.3.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70