CVE-2026-76252: Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13 are exposed when they can be persuaded to visit an attacker-controlled malicious web page. The impact is limited to data and actions available through the affected user's own Splunk access.
What does an attacker need to exploit it?
The attacker does not need to authenticate, but must successfully phish or otherwise trick an affected user into initiating a request in their browser. Exploitation is not described as something an unauthenticated attacker can perform at will.
What can successful exploitation allow?
It can cause unauthorized JavaScript to run in the victim's browser. This may allow access to relevant data available to that user and actions affecting system integrity.
Which releases address the issue?
The affected version ranges are below 10.4.2, 10.2.6, 10.0.9, and 9.4.13. Updating to the applicable listed release or later resolves the affected version condition described in the advisory.