CVE-2026-76326
Low
No strong exploitation signal.
CVSS base
5.7
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
0.2%
16.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-79
Published 2026-08-19 · modified 2026-08-26
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | L | Low |
| User Interaction | R | Required |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-08-19 — Published (NVD)
- 2026-08-26 — Last modified (NVD)
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.