CVE-2026-76333

Received Received - Intake

Stored XSS in Splunk Enterprise Dashboard Studio

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or actions available through Splunk Web to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before processing them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76333

EUVD

EUVD-2026-62898

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	10.4.2
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	9.4.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can create a malicious Dashboard Studio workflow action with a crafted URL. When another user selects this action and clicks Continue, attacker-controlled JavaScript executes in their browser. This happens because Dashboard Studio fails to properly validate URLs before processing them.

Impact Analysis

An attacker could trick a user into initiating a request, leading to unauthorized access to data or actions available through Splunk Web. The attacker needs to phish the user to trigger the request. The impact includes potential exposure of sensitive data or unauthorized actions performed by the victim user.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70