CVE-2026-76252: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13 contain a reflected Cross-Site Scripting vulnerability due to improper validation of the origin and source of messages received by a page message handler in Splunk Web. An unauthenticated attacker can exploit this by tricking a user into visiting a crafted malicious web page, enabling unauthorized JavaScript execution in the victim's browser. This vulnerability impacts confidentiality and integrity by potentially exposing all data accessible to the user and allowing unauthorized actions within the system. The vulnerability requires user interaction and cannot be exploited at will by the attacker.

Successful exploitation allows unauthorized JavaScript execution in the context of the victim user's browser session, potentially leading to unauthorized access to all data available to that user and unauthorized actions affecting system integrity. The attacker must trick the user into visiting a malicious page, so exploitation depends on social engineering. There is no indication of availability impact. The vulnerability affects confidentiality and integrity.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13. Users should upgrade to these versions or later to remediate the vulnerability. Since this is a reflected XSS requiring user interaction, educating users about phishing risks can reduce exploitation likelihood. No other vendor advisory or patch information is provided, so check Splunk's official advisories for the latest remediation guidance.