CVE-2026-76330

Received Received - Intake

Cross-Site Scripting in Splunk Enterprise Monitoring Console

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build forwarder dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76330

EUVD

EUVD-2026-62895

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows an unauthenticated attacker to trick an authenticated user into opening a malicious link. When opened, the link executes attacker-controlled SPL code using the authenticated user's permissions. The issue stems from insufficient validation of data used in Monitoring Console searches.

Detection Guidance

This vulnerability requires user interaction to exploit, so detection involves monitoring for suspicious links or SPL execution. Check Splunk logs for unusual Monitoring Console dashboard searches or SPL commands. Look for unauthenticated access attempts to the Monitoring Console or unexpected user actions.

Impact Analysis

An attacker could access sensitive data or perform actions available to the authenticated user, such as querying Splunk data or modifying configurations. The impact depends on the user's permissions but could include data breaches or unauthorized system changes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Compliance risks include data breaches, lack of user consent, and failure to implement adequate security controls.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later immediately. If upgrading is not possible, restrict access to the Monitoring Console and disable unauthenticated access. Monitor for phishing attempts targeting users with Monitoring Console access.

Hi! I’m here to help you understand CVE-2026-76330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70