CVE-2026-20258: Splunk Enterprise & Cloud Platform Stored XSS in Dashboard HTML Panels

Technical summary

CVE-2026-20258 is a stored XSS vulnerability (CWE-79) affecting Splunk's classic dashboard HTML panel functionality. A user with minimal privileges can store malicious JavaScript that persists in the dashboard configuration. When a second user accesses the dashboard, the injected script executes in their browser context without additional user consent. The vulnerability has a CVSS 3.1 score of 7.1 (HIGH) with a vector reflecting network access, high attack complexity (due to UI/phishing requirement), low privilege requirement, required user interaction, and high impact to confidentiality, integrity, and availability within the session scope.

Business impact

Successful exploitation could allow an attacker to steal session tokens, manipulate dashboard data displayed to other users, redirect users to malicious sites, or harvest credentials. In Splunk environments managing sensitive operational data, logs, or security information, this could lead to unauthorized data access or actionable intelligence about infrastructure and security controls. The impact scales with dashboard visibility—dashboards viewed by many users or admins amplify the potential for lateral movement or privilege escalation.

Affected systems

Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13 are vulnerable. Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132 are affected. Organizations running any of these versions should prioritize inventory and patching. Splunk versions at or above these thresholds have remediation in place.

Exploitability

While the CVSS score is HIGH (7.1), actual exploitability is constrained by two factors: (1) the attacker must hold a non-admin, non-power user role, meaning they need valid credentials or compromise of a low-privileged account, and (2) the attack requires phishing or social engineering to induce the victim to access the malicious dashboard. There is no evidence of automated or opportunistic exploitation in the wild (KEV status is false). This makes it a targeted attack vector rather than a widespread threat, though determined adversaries with internal access could weaponize it.

Remediation

Upgrade Splunk Enterprise to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13 or later, depending on your current release line. Upgrade Splunk Cloud Platform to version 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 or later. Verify against Splunk's official advisory for your specific version and deployment model to confirm the correct patch. As an interim mitigation, restrict low-privileged user permissions to create or edit classic dashboards and review existing dashboard permissions and content for suspicious scripts.

Patch guidance

Splunk has released patches across multiple version branches to address this vulnerability. Cloud customers should verify their current platform version and apply updates according to Splunk's patch schedule. Enterprise customers should test patches in a staging environment before production deployment, as dashboard functionality is typically user-facing and updates may require brief downtime or cache clearing. Verify the exact patch version required for your release line in Splunk's security advisory.

Detection guidance

Monitor Splunk audit logs for low-privileged users creating or modifying classic dashboards, particularly those with HTML panels. Look for suspicious JavaScript patterns (e.g., fetch, XMLHttpRequest, localStorage access) in dashboard XML configurations. Review dashboard change history and compare XML before and after modifications. Correlate dashboard modifications with subsequent user session anomalies (unusual data access, credential submissions to external URLs). Consider deploying a Web Application Firewall (WAF) or browser security controls in front of Splunk to detect or block injected scripts, though this is a secondary measure to patching.

Why prioritize this

This vulnerability warrants prompt patching because it affects multiple versions across two product lines and combines stored persistence with high-impact confidentiality and integrity risks. While exploitability is limited by privilege and social engineering requirements, organizations with diverse user bases or permissive dashboard-creation policies face meaningful risk. Prioritize patching systems accessible to many users or those managing sensitive data. The HIGH CVSS score and lack of automatic mitigation justify rapid deployment once tested.

Risk score, explained

CVSS 3.1 score of 7.1 reflects: Network attack vector (AV:N) due to browser-based exploitation, high attack complexity (AC:H) because social engineering and user interaction are required, low privilege requirement (PR:L) since non-admin users can trigger it, required user interaction (UI:R) to view the malicious dashboard, unchanged scope (S:U) as impact is limited to the affected application, and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) within that scope. The HIGH severity is appropriate for a stored XSS with broad impact, though the social engineering barrier moderates the practical risk.

Frequently asked questions