In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a… (CVE-2026-76318)

CVE-2026-76318 is a cross-site scripting (XSS) vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the schedule_search capability can inject a malicious script into an alert trigger condition field. When another user opens the crafted alert link, the script executes in their browser context, potentially exposing all data accessible to that user. The root cause is the lack of proper escaping of special characters in the alert threshold value within the alert trigger condition markup generated by Splunk Web. Successful exploitation requires another user to open the malicious link, making user interaction necessary.

An attacker with schedule_search capability can inject malicious scripts that execute in the browsers of other users who open the crafted alert links. This can lead to unauthorized access to sensitive data available to the victim user. The vulnerability does not impact system integrity or availability but compromises confidentiality through client-side script execution. The CVSS 3.1 base score is 5.7 (medium severity), reflecting network attack vector, low complexity, required privileges, and user interaction.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability by properly escaping special characters in alert trigger condition markup. Users should upgrade to one of these fixed versions to remediate the issue. Until upgraded, restrict schedule_search capability to trusted users only and educate users to avoid opening suspicious alert links. Patch status is confirmed by the vendor advisory versions listed.