CVE-2026-76325

Received Received - Intake

Stored XSS in Splunk Enterprise via Malicious UI-Tour Object

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all relevant data and affect system integrity within the second user permissions. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76325

EUVD

EUVD-2026-63132

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	9.4.14
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	10.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can create a malicious ui-tour object that matches an auto-tour page name and share it at the app level. When another authenticated user visits a standard Splunk Web page, the malicious object executes arbitrary JavaScript in their browser.

Impact Analysis

The vulnerability allows an attacker to execute arbitrary JavaScript in the browser of another authenticated user. This could expose all relevant data accessible to the affected user and affect system integrity within the second user's permissions. The impact includes potential data theft, unauthorized actions, and compromised system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's privacy and security rules. Organizations using affected Splunk versions may face compliance violations, data breaches, and potential regulatory penalties.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later) to address the XSS vulnerability in ui-tour knowledge objects.

Hi! I’m here to help you understand CVE-2026-76325. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70