CVE-2026-20258
Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
| CWE | CWE-79 |
| Vendor | splunk |
| Product | splunk enterprise |
| Published | Jun 10, 2026 |
| Last Updated | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for splunk splunk enterprise
Be the first to know when new high vulnerabilities affecting splunk splunk enterprise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Splunk / Splunk Enterprise
10.2 < 10.2.4 10.0 < 10.0.7 9.4 < 9.4.12 9.3 < 9.3.13
Splunk / Splunk Cloud Platform
10.3.2512 < 10.3.2512.11 10.2.2510 < 10.2.2510.15 10.1.2507 < 10.1.2507.23 9.3.2411 < 9.3.2411.132
References
Credits
Tony Tong