CVE-2026-76324

Received Received - Intake

Stored XSS in Splunk Enterprise via Malicious Web Tour

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the browser of the affected user, allowing for access to all relevant data available to that user. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web renders tour content and tour navigation links without sufficient output encoding and accepts a tour selector value that can be treated as markup. The vulnerability requires another user to open a crafted tour link. The user who holds the "power" Splunk role should not be able to trigger JavaScript execution in another user's browser without that user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76324

EUVD

EUVD-2026-63131

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	9.4.14
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	From 9.4.14 (inc) to 10.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can create a malicious Splunk Web tour that executes arbitrary JavaScript in another user's browser when they open a crafted tour link. The JavaScript runs with the same data access as the affected user.

Impact Analysis

An attacker could steal sensitive data, perform actions on behalf of the user, or compromise the user's account. The impact depends on the user's permissions and data access. The vulnerability requires user interaction to exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Splunk versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later) to address the XSS vulnerability. Ensure users with the 'power' role are trusted and limit their access until updates are applied.

Hi! I’m here to help you understand CVE-2026-76324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70