CVE-2026-76325
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a malicious ui-tour knowledge object and share it at the app level. The object can execute arbitrary JavaScript in another user's browser.
Risk Assessment
The risk includes arbitrary JavaScript execution in another user's context, potentially leading to data exposure and system integrity compromise.
Recommendation
Upgrade to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later and restrict object sharing permissions.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all relevant data and affect system integrity within the second user permissions. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image.