Threats Tagged 'cve-2026-76328'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format (PDF) file, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Splunk Web does not sufficiently validate dashboard content before processing PDF exports. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Generate PDFs of your reports and dashboards (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/9.4/report-management/generate-pdfs-of-your-reports-and-dashboards) in the Splunk documentation.

CVE-2026-76328 affects Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" Splunk role to store malicious Search Processing Language (SPL) code in a dashboard. When another authenticated user exports this dashboard as a PDF, the injected SPL executes with the exporting user's permissions, potentially accessing or modifying their data. The vulnerability arises from insufficient validation of dashboard content during PDF export. Exploitation requires phishing the affected user to trigger the export action. The vulnerability has a CVSS score of 6.7, indicating medium severity.