CVE-2026-76310, CVE-2026-76311, CVE-2026-76312: Splunk Embedded Report Flaws (CVSS 9.4) Affect System Integrity

TL;DR

Splunk fixed 60 vulnerabilities in Splunk Enterprise on August 19, 2026. Three critical flaws share a 9.4 score. Each lets an unauthenticated user with an embedded report token access data and affect system integrity. Splunk reports no confirmed exploitation in the wild.

Notable CVEs

Why It Matters

Splunk Enterprise stores logs, alerts, and search results for large organizations. A break in its access controls therefore exposes sensitive data. The three top flaws let an attacker affect system integrity across the platform.

Each critical bug needs no authentication. An attacker only needs an embedded report token or the page that hosts it. Because report owners often hold the admin role, the reach can be broad.

How the Attacks Work

All three critical flaws map to CWE-284, improper access control. They center on how Splunk handles embedded reports and their dispatch archives.

CVE-2026-76310 (CVSS 9.4)

Embedded report access does not block REST API dispatch archive downloads. As a result, a token holder can pull the archive and recover session material. That material grants access to the report owner’s data, letting an attacker affect system integrity. Splunk details this in its Splunk Enterprise hardening advisory.

CVE-2026-76311 (CVSS 9.4)

The embedded report authorization flow fails to block archive downloads in time. Splunk starts sending the archive before the check completes. Exposed session material then opens the door to the wider platform.

CVE-2026-76312 (CVSS 9.4)

Here, anyone who can read a page’s HTML source may abuse the report. The dispatch archive path does not enforce the embedded-report boundary. Sensitive session data sits inside the archived search job, so an attacker can seize it.

Other Notable Flaws

Beyond the three critical bugs, the release fixes several high-severity issues at 8.8. These include multiple remote code execution paths through the REST API and Web Manager. Splunk also patched SPL injection, SSRF, and privilege escalation flaws.

Affected Versions

The flaws affect Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Two CVEs, 76338 and 76352, need extra remediation steps. Splunk does not publish install-count estimates for exposed instances.

Patch and Mitigation Steps

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14. To blunt the embedded report bugs, set allowEmbedTokenAuth to false in server.conf if you do not use the feature. Turning off Splunk Web also helps for some flaws. Review the advisory for the two CVEs that need added steps.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.