In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML)… (CVE-2026-76312)
Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 contain a critical vulnerability that allows an unauthenticated user who can read the HTML source of a page embedding a Splunk report to access sensitive session material. This occurs because the dispatch archive download path does not properly enforce authorization boundaries, exposing session data in archived search-job data. This can lead to unauthorized access to relevant data and impact system integrity.
AI Analysis
Technical Summary
CVE-2026-76312 affects Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from improper enforcement of authorization boundaries in the dispatch archive download path, which exposes sensitive session material in archived search-job data embedded in HTML pages. An unauthenticated attacker who can read the HTML source of a page embedding a Splunk report can leverage this exposure to access all relevant data and potentially impact system integrity. The issue relates to CWE-284 (Improper Access Control).
Potential Impact
An unauthenticated attacker can gain unauthorized access to sensitive session information and data relevant to embedded Splunk reports. This compromises confidentiality and integrity of the system data. The vulnerability has a CVSS 3.1 score of 9.4 (critical), indicating high impact on confidentiality and integrity with low attack complexity and no privileges or user interaction required.
Mitigation Recommendations
A fix is available in Splunk Enterprise versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to at least these versions to remediate the vulnerability. Refer to Splunk's official documentation on additional configuration for embedded reports and embedding scheduled reports for further guidance. Patch status is not explicitly stated in the input, but the presence of fixed versions implies official fixes have been released.
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML)… (CVE-2026-76312)
Description
Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 contain a critical vulnerability that allows an unauthenticated user who can read the HTML source of a page embedding a Splunk report to access sensitive session material. This occurs because the dispatch archive download path does not properly enforce authorization boundaries, exposing session data in archived search-job data. This can lead to unauthorized access to relevant data and impact system integrity.
CVSS v3.1
Score 9.4critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76312 affects Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from improper enforcement of authorization boundaries in the dispatch archive download path, which exposes sensitive session material in archived search-job data embedded in HTML pages. An unauthenticated attacker who can read the HTML source of a page embedding a Splunk report can leverage this exposure to access all relevant data and potentially impact system integrity. The issue relates to CWE-284 (Improper Access Control).
Potential Impact
An unauthenticated attacker can gain unauthorized access to sensitive session information and data relevant to embedded Splunk reports. This compromises confidentiality and integrity of the system data. The vulnerability has a CVSS 3.1 score of 9.4 (critical), indicating high impact on confidentiality and integrity with low attack complexity and no privileges or user interaction required.
Mitigation Recommendations
A fix is available in Splunk Enterprise versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to at least these versions to remediate the vulnerability. Refer to Splunk's official documentation on additional configuration for embedded reports and embedding scheduled reports for further guidance. Patch status is not explicitly stated in the input, but the presence of fixed versions implies official fixes have been released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8x8r-pr28-52g6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76312"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a870a90acd9273b49b5a21e
Added to database: 08/20/2026, 14:09:20 UTC
Last enriched: 08/20/2026, 14:58:38 UTC
Last updated: 08/20/2026, 15:51:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.