CVE-2026-20258: Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

Q: What is the severity of CVE-2026-20258?

CVE-2026-20258 has a severity rating of 7.1, which is classified as high.

Q: What types of Splunk versions are affected by CVE-2026-20258?

CVE-2026-20258 affects Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as specific versions of Splunk Cloud Platform.

Q: How can I mitigate CVE-2026-20258?

To mitigate CVE-2026-20258, update to the latest patched versions of Splunk Enterprise or Splunk Cloud Platform.

Q: Who can exploit CVE-2026-20258?

CVE-2026-20258 can be exploited by low-privileged users not holding the 'admin' or 'power' Splunk roles.

Q: What type of vulnerability is CVE-2026-20258?

CVE-2026-20258 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

Published Jun 10, 2026

Updated

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user.

The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

Affected Software

10 affected components

Splunk Splunk Enterprise<10.2.4, <10.0.7, <9.4.12, <9.3.13

Splunk Splunk Cloud Platform<10.3.2512.11, <10.2.2510.15, <10.1.2507.23, <9.3.2411.132

Splunk splunk>=9.3.0<9.3.13

Splunk splunk>=9.4.0<9.4.12

Splunk splunk>=10.0.0<10.0.7

Splunk splunk>=10.2.0<10.2.4

Splunk Splunk Cloud Platform>=9.3.2411<9.3.2411.132

Splunk Splunk Cloud Platform>=10.1.2507<10.1.2507.23

Splunk Splunk Cloud Platform>=10.2.2510<10.2.2510.15

Splunk Splunk Cloud Platform>=10.3.2512<10.3.2512.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.2.4
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.0.7
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.4.12
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.3.13
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.3.2512.11
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.2.2510.15
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.1.2507.23
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 9.3.2411.132

Event History

Jun 10, 2026

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-20258?

CVE-2026-20258 has a severity rating of 7.1, which is classified as high.

What types of Splunk versions are affected by CVE-2026-20258?

CVE-2026-20258 affects Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as specific versions of Splunk Cloud Platform.

How can I mitigate CVE-2026-20258?

To mitigate CVE-2026-20258, update to the latest patched versions of Splunk Enterprise or Splunk Cloud Platform.

Who can exploit CVE-2026-20258?