CVE-2026-76337

Received Received - Intake

Splunk Enterprise Path Traversal Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76337

EUVD

EUVD-2026-62902

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows an unauthenticated user to read JavaScript files outside the designated Splunk Web static directory. This occurs because Splunk Web fails to restrict static file requests to the configured static directory.

Detection Guidance

Check Splunk Enterprise version with: splunk version. Inspect web access logs for unusual static file requests outside the configured directory. Look for patterns like unauthorized access to /static/../ paths.

Impact Analysis

An attacker could exploit this to access sensitive JavaScript files, potentially exposing internal configurations, user data, or other confidential information. This may lead to further attacks or data breaches if the exposed files contain credentials or API keys.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR or HIPAA by exposing sensitive data, leading to unauthorized access to personal or health information. Organizations may face penalties for failing to protect such data adequately.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later immediately. Restrict network access to Splunk Web ports until patched. Monitor for suspicious activity in logs.

Hi! I’m here to help you understand CVE-2026-76337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70