CVE-2026-76328

Received Received - Intake

Stored XSS in Splunk Enterprise PDF Export

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format (PDF) file, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Splunk Web does not sufficiently validate dashboard content before processing PDF exports. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Generate PDFs of your reports and dashboards (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/9.4/report-management/generate-pdfs-of-your-reports-and-dashboards) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76328

EUVD

EUVD-2026-62893

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can inject malicious Search Processing Language (SPL) code into a dashboard. When another user exports this dashboard as a PDF, the malicious SPL runs with the exporter's permissions, potentially accessing or modifying their data. The issue arises because Splunk Web does not properly validate dashboard content before PDF generation.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions for affected releases. Use Splunk's CLI command 'splunk version' to verify the installed version. Compare it against versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Additionally, review dashboard configurations for suspicious SPL code, especially those created by users with the 'power' role.

Impact Analysis

If you use an affected Splunk Enterprise version, an attacker could trick a user with the 'power' role into creating a malicious dashboard. When another user exports this dashboard as a PDF, the attacker could access or modify data available to that user. The attacker needs to trick the user into initiating the export request within their browser.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data access or modification. An attacker with the power role could inject malicious SPL to access sensitive data during PDF export, violating confidentiality requirements under GDPR and HIPAA. The risk depends on the data exposed and whether the affected user has access to regulated information.

Mitigation Strategies

Upgrade Splunk Enterprise to the latest patched versions (10.4.1, 10.2.6, 10.0.9, or 9.4.14). Restrict the 'power' role to trusted users only. Review and audit dashboards for unauthorized SPL code. Disable PDF export functionality if not required. Monitor user activity for unusual dashboard exports.

Hi! I’m here to help you understand CVE-2026-76328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70