In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour… (CVE-2026-76325)

CVE-2026-76325 is a high-severity Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise. It affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image. A user with the "power" role can store a malicious ui-tour knowledge object that matches an auto-tour page name and share it at the app level. When another authenticated user visits a standard Splunk Web page, the malicious JavaScript executes in their browser, potentially exposing all relevant data accessible to that user and impacting system integrity. The CVSS v3.1 score is 7.3, reflecting high impact on confidentiality and integrity with low attack complexity and requiring user interaction.

Successful exploitation allows an attacker with the "power" role to execute arbitrary JavaScript in the browser of other authenticated users. This can lead to exposure of sensitive data accessible to the victim user and compromise system integrity within their permission scope. There is no impact on availability. The vulnerability requires the attacker to have the "power" role and the victim to be authenticated and visit a standard Splunk Web page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the "power" role to trusted users only and monitor for suspicious ui-tour knowledge objects. Avoid visiting untrusted Splunk Web pages while authenticated. Follow vendor guidance once published.