In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious… (CVE-2026-76252)

CVE-2026-76252 is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise's web interface. It arises because Splunk Web does not validate the origin and source of messages received by a page message handler. An unauthenticated attacker can exploit this by tricking a user into visiting a crafted malicious web page, which causes unauthorized JavaScript to run in the context of the user's browser session. This allows the attacker to access data and perform actions with the user's privileges. The vulnerability affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13. Exploitation requires user interaction and high attack complexity.

Successful exploitation allows unauthorized JavaScript execution in the victim's browser, potentially leading to unauthorized access to all data accessible to that user and unauthorized actions affecting system integrity. However, exploitation requires the attacker to phish the user to initiate a request, and the attacker cannot exploit the vulnerability at will. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of phishing attempts that could trigger this vulnerability. Monitor vendor communications for updates on patches or mitigations.