CVE-2026-76324: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a Cross-Site Scripting (XSS) vulnerability exists due to insufficient output encoding of user-controllable input in Splunk Web tours. A user with the "power" role can craft a malicious tour that executes arbitrary JavaScript in the browser of another user who opens the crafted link. This JavaScript runs with the privileges of the affected user, potentially exposing all data accessible to that user. The vulnerability requires that the victim user interact by opening the malicious tour link. The flaw stems from rendering tour content and navigation links without proper encoding and accepting a tour selector value treated as markup.

Successful exploitation allows an attacker with the "power" Splunk role to execute arbitrary JavaScript in the browser of another user who opens a crafted tour link. This can lead to unauthorized access to all data available to the victim user within Splunk Enterprise. The vulnerability affects confidentiality but does not impact integrity or availability. Exploitation requires user interaction and privileges to create malicious tours.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these versions or later to remediate this vulnerability. Until patched, restrict the "power" role to trusted users and educate users to avoid opening untrusted tour links. Patch status is confirmed by the presence of fixed versions.