Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-76312 – Authorization Bypass / Session Hijack via Embedded Reports – Splunk Enterprise (9.4

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-76312 is a critical improper access control vulnerability (CWE-284) in Splunk Enterprise’s embedded reports functionality. An unauthenticated attacker who obtains a valid embedded report token can abuse the dispatch archive download path to extract session material belonging to the report owner, effectively bypassing authorization boundaries. With a CVSS v3.1 base score of 9.4 (Critical), successful exploitation grants the attacker access to all data available to the report owner and can affect the integrity of the Splunk instance.

Technical details

  • Root cause: The endpoint used to download dispatch archives associated with embedded reports does not properly enforce authorization checks, allowing HTML source and session-related material to be read outside the intended scope of the embed token.
  • Trigger conditions: An attacker needs only a valid embedded report token (which may be exposed via a shared/embedded page) to request the dispatch archive for that report; no authenticated Splunk session or credentials are required.
  • Attack vector: Network — the flaw is reachable via Splunk Web/REST over HTTP(S) without authentication (AV:N, PR:N, UI:N).
  • Impact: Disclosure of session information tied to the report owner, which can be leveraged to access data the owner is entitled to view, resulting in high confidentiality impact, high integrity impact, and low availability impact.
  • This CVE was disclosed alongside two related embedded-report access-control issues, CVE-2026-76310 and CVE-2026-76311, all sharing the same underlying weakness class in the embedded reports feature.

Affected software

  • Splunk Enterprise 9.4.0 – 9.4.13 (fixed in 9.4.14)
  • Splunk Enterprise 10.0.0 – 10.0.8 (fixed in 10.0.9)
  • Splunk Enterprise 10.2.0 – 10.2.5 (fixed in 10.2.6)
  • Splunk Enterprise 10.4.0 (fixed in 10.4.1)

Severity

  • CVSS v3.1 Base Score: 9.4 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigation and recommended actions

  • Immediate: Upgrade Splunk Enterprise to 9.4.14, 10.0.9, 10.2.6, or 10.4.1 (or later), matching your current release branch.
  • If patching is not immediately possible:
    • Disable the embedded reports token-based authentication mechanism by setting allowEmbedTokenAuth = false.
    • Disable Splunk Web entirely if embedded reports are not required for your environment, removing exposure of the vulnerable web path.
    • Audit and rotate any embedded report tokens that may have been shared externally, since exposed tokens are the prerequisite for exploitation.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge