In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web… (CVE-2026-76324)

CVE-2026-76324 is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" Splunk role to create a malicious Splunk Web tour that executes arbitrary JavaScript in the browser of another user who opens the crafted tour link. The vulnerability is due to Splunk Web rendering tour content and navigation links without sufficient output encoding and accepting a tour selector value that can be treated as markup. This enables JavaScript execution in the context of the affected user's browser, potentially exposing all data accessible to that user. Exploitation requires the targeted user to interact by opening the malicious link, and the "power" role user should not be able to trigger this without such interaction.

Successful exploitation allows an attacker with the "power" Splunk role to execute arbitrary JavaScript in the browser of another user who opens a crafted tour link. This can lead to unauthorized access to all data available to the affected user within Splunk Web. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality of user data accessible in the browser session.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the "power" Splunk role to trusted users only and educate users to avoid opening untrusted or suspicious Splunk Web tour links.