CVE-2026-76329

Received Received - Intake

Cross-Site Scripting in Splunk Enterprise Monitoring Console

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76329

EUVD

EUVD-2026-62894

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows an unauthenticated attacker to trick an admin user into opening a malicious link. When opened, the link executes attacker-controlled SPL code using the admin's permissions, potentially exposing or modifying data.

Detection Guidance

To detect this vulnerability, monitor Splunk Enterprise instances for unauthorized SPL execution in Monitoring Console. Check Splunk logs for suspicious search commands or unexpected data modifications. Look for crafted links or phishing attempts targeting admin users.

Impact Analysis

An attacker could exploit this to access sensitive data available to admin users or alter lookup data. This requires tricking the admin into clicking a crafted link, making phishing a key factor in exploitation.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later immediately. Disable Monitoring Console access for non-admin users until patched. Train users to avoid clicking untrusted links, especially those with admin privileges.

Hi! I’m here to help you understand CVE-2026-76329. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70