CVE-2026-76326

Received Received - Intake

Cross-Site Scripting in Splunk Enterprise Dashboard Views

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76326

EUVD

EUVD-2026-63133

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A non-admin user can create a dashboard view that executes JavaScript when another user hovers over a sparkline table cell. This allows the attacker to access the victim's data and system integrity.

Impact Analysis

If you use an affected Splunk Enterprise version, an attacker with limited access could steal sensitive data or manipulate dashboard views. Users with minimal privileges could gain unauthorized access to data or system functions through crafted dashboard interactions.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Splunk versions may fail compliance audits due to insufficient access controls and data exposure risks.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70