CVE-2026-76325: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

In Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a Cross-Site Scripting (XSS) vulnerability exists due to improper neutralization of user-controllable input in UI-tour knowledge objects. A user holding the "power" role can create a malicious tour object that matches an auto-tour page name and share it at the app level. When another authenticated user visits a standard Splunk Web page, the malicious JavaScript executes in their browser, potentially exposing all relevant data accessible to that user and impacting system integrity. The vulnerability stems from Splunk Web resolving auto-tour entries from the app namespace and using untrusted content without proper sanitization.

Successful exploitation allows an attacker with the "power" role to execute arbitrary JavaScript in the browsers of other authenticated users, potentially exposing sensitive data and compromising system integrity within the scope of the victim user's permissions. This can lead to data disclosure and unauthorized actions performed on behalf of the victim user. The vulnerability does not impact availability.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these versions or later to remediate the issue. No information about alternative mitigations or workarounds is provided; therefore, upgrading is the recommended action.