CVE-2026-20258

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.11 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132

Description A low-privileged user without admin or power roles can store a malicious script within a classic dashboard HTML panel. This allows unauthorized JavaScript code to execute in the browser of another user. Exploitation requires the attacker to phish the victim, tricking them into initiating a request within their browser.

Recommendations Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.11 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.