CVE-2026-76349

Received Received - Intake

Cross-Site Scripting (XSS) in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language (SPL) commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access all relevant data. The vulnerability does not affect Splunk Enterprise 10.4 versions and above. The vulnerability is possible because Splunk Web substitutes form token values supplied through the Uniform Resource Locator (URL) into SPL searches without neutralizing them. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Token reference (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/simple-xml-dashboards/10.2/simple-xml-reference/token-reference) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76349

EUVD

EUVD-2026-62914

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker to trick an authenticated Splunk user into executing arbitrary SPL commands through a crafted web link. The attacker exploits how Splunk Web substitutes URL values into SPL searches without proper sanitization. The commands run with the permissions of the authenticated user and can access all relevant data.

Detection Guidance

Check Splunk Enterprise version with: splunk version. If version is below 10.2.6, 10.0.9, or 9.4.14, the system is vulnerable. Monitor Splunk Web logs for unusual SPL commands executed via crafted URLs.

Impact Analysis

An attacker could gain unauthorized access to sensitive data by tricking a user into clicking a malicious link. This could lead to data breaches, unauthorized queries, or modifications to Splunk configurations. The impact depends on the permissions of the tricked user.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements like GDPR (data protection) or HIPAA (health data privacy). Organizations using vulnerable Splunk versions may face regulatory penalties or reputational damage if exploited.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.2.6, 10.0.9, or 9.4.14 or higher immediately. Disable URL-based SPL injection by reviewing and restricting token substitution in Splunk Web configurations.

Hi! I’m here to help you understand CVE-2026-76349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70