CVE-2026-76311

{"id": "CVE-2026-76311", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76311", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T03:57:02.105051Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.4", "lessThan": "10.4.2", "versionType": "custom"}, {"status": "affected", "version": "10.2", "lessThan": "10.2.6", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.9", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.14", "versionType": "custom"}]}]}], "published": "2026-08-19T22:17:14.837", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0801", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation."}, {"lang": "es", "value": "En versiones de Splunk Enterprise anteriores a 10.4.2, 10.2.6, 10.0.9 y 9.4.14, un usuario no autenticado que tiene un token de informe incrustado podr\u00eda descargar el archivo de despacho para un trabajo de b\u00fasqueda de informe incrustado y usar material de sesi\u00f3n expuesto para acceder a todos los datos relevantes y afectar la integridad del sistema en la instancia de la plataforma Splunk. La vulnerabilidad es posible porque el flujo de autorizaci\u00f3n de informes incrustados no bloquea las solicitudes de descarga del archivo de despacho antes de que Splunk Enterprise comience a enviar el archivo al solicitante. Para m\u00e1s informaci\u00f3n, consulte Configuraci\u00f3n adicional para informes incrustados (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) e Incrustar informes programados (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) en la documentaci\u00f3n de Splunk."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119", "versionEndExcluding": "9.4.14", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB", "versionEndExcluding": "10.0.9", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C", "versionEndExcluding": "10.2.6", "versionStartIncluding": "10.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC", "versionEndExcluding": "10.4.2", "versionStartIncluding": "10.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}