In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio… (CVE-2026-76333)

CVE-2026-76333 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" role can store a malicious Dashboard Studio workflow action containing a crafted URL. When another authenticated user selects this action and continues, the malicious JavaScript runs in their browser due to insufficient URL validation in Dashboard Studio. This cross-site scripting (XSS) vulnerability requires the attacker to phish the victim to initiate the action. The vulnerability impacts confidentiality, integrity, and availability by exposing data and enabling unauthorized actions through Splunk Web.

Successful exploitation can lead to execution of attacker-controlled JavaScript in the browser of an authenticated user, potentially exposing sensitive data accessible through Splunk Web and allowing unauthorized actions. The vulnerability requires user interaction (phishing) and a user with the "power" role to initially store the malicious action. The attacker cannot exploit this vulnerability without tricking a user into triggering the stored action.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the "power" role to trusted users only, and educate users to avoid interacting with suspicious workflow actions or links. Monitor Splunk documentation and vendor advisories for updates on patches addressing this vulnerability.