PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20257 Splunk CVE debrief

A vulnerability was found in Splunk Enterprise and Splunk Cloud Platform. A low-privileged user could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it. This is possible because classic dashboard panels do not fully validate style attribute values, allowing requests to reach external domains outside the configured Trusted Domains List.

Vendor
Splunk
Product
Splunk Enterprise
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-15
Advisory published
2026-06-10
Advisory updated
2026-06-15

Who should care

Administrators and users of Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132.

Technical summary

The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will. The CVSS score for this vulnerability is 5.7, with a severity rating of MEDIUM.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update Splunk Enterprise to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13, or later.
  • Update Splunk Cloud Platform to version 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132, or later.
  • Restrict access to classic dashboards to only trusted users.
  • Configure the Trusted Domains List to only include necessary external domains.

Evidence notes

The CVE record was published on June 10, 2026, and last modified on June 10, 2026.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20257 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20257

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20257 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20257

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.