CVE-2026-76311

{
  "id": "CVE-2026-76311",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T22:17:14.837",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation."
    },
    {
      "lang": "es",
      "value": "En versiones de Splunk Enterprise anteriores a 10.4.2, 10.2.6, 10.0.9 y 9.4.14, un usuario no autenticado que tiene un token de informe incrustado podría descargar el archivo de despacho para un trabajo de búsqueda de informe incrustado y usar material de sesión expuesto para acceder a todos los datos relevantes y afectar la integridad del sistema en la instancia de la plataforma Splunk. La vulnerabilidad es posible porque el flujo de autorización de informes incrustados no bloquea las solicitudes de descarga del archivo de despacho antes de que Splunk Enterprise comience a enviar el archivo al solicitante. Para más información, consulte Configuración adicional para informes incrustados (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) e Incrustar informes programados (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) en la documentación de Splunk."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk Enterprise",
          "versions": [
            {
              "version": "10.4",
              "lessThan": "10.4.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.2",
              "lessThan": "10.2.6",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.0",
              "lessThan": "10.0.9",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.4",
              "lessThan": "9.4.14",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T03:57:02.105051Z",
          "id": "CVE-2026-76311",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.14",
              "matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "10.0.0",
              "versionEndExcluding": "10.0.9",
              "matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "10.2.0",
              "versionEndExcluding": "10.2.6",
              "matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "10.4.0",
              "versionEndExcluding": "10.4.2",
              "matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0801",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}