splunk_advisories
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Jun 10, 2026 00:00 UTC
- Retrieved
- Oct 08, 2026 03:55 UTC
SVD-2026-0608: Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The
Reference details
- Source category
- Vendor advisories
- Report title
SVD-2026-0608: Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise- First reported
- Jun 10, 2026 00:00 UTC
- Last reported
- Jun 10, 2026 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:55 UTC
- Record ID
5a652f68f2a5e4ab6b125e872dd91e59114825a43c94f92005f4b06bdc535edf
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.