CVE-2026-20162: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2026-20162 is a Stored Cross-Site Scripting (XSS) vulnerability via path traversal in Splunk Enterprise and Splunk Cloud Platform, allowing a low-privileged authenticated user to inject malicious JavaScript into other users' browsers. It affects Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9, and Splunk Cloud Platform versions below 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, and 9.3.2411.123. The vulnerability was published on March 11, 2026, with a patch advisory released on March 23, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) (Splunk Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and arises from insufficient input validation combined with a path traversal weakness at the /manager/launcher/data/ui/views/_new endpoint used for creating Views (Settings → User Interface → Views). A low-privileged user without the "admin" or "power" Splunk roles can craft a malicious payload during View creation that is stored server-side and later rendered in the browser of another user. Exploitation requires social engineering — the attacker must phish the victim into initiating a request within their browser, meaning the vulnerability cannot be triggered at will by the authenticated attacker alone (Splunk Advisory).

Successful exploitation could result in execution of unauthorized JavaScript code in the browser of an authenticated Splunk user, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or data exfiltration from the Splunk environment. The confidentiality impact is rated High, while integrity impact is Low and there is no availability impact. Because exploitation requires user interaction via phishing, the attack surface is somewhat constrained, but the consequences for targeted privileged users (e.g., Splunk admins) could be significant (Splunk Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Splunk Advisory). The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection coverage exists via Tenable Nessus plugin 301864 (Tenable).

1. Reconnaissance: Identify a target Splunk Enterprise or Cloud Platform instance running a vulnerable version (Enterprise < 10.2.0/10.0.3/9.4.9/9.3.9; Cloud Platform < 10.2.2510.4/10.1.2507.15/10.0.2503.11/9.3.2411.123) and obtain low-privileged credentials (any role except "admin" or "power").
2. Craft malicious View payload: Log in with the low-privileged account and navigate to Settings → User Interface → Views. At the /manager/launcher/data/ui/views/_new endpoint, craft a View creation request containing a malicious JavaScript payload embedded via a path traversal technique in the View name or content field.
3. Store the payload: Submit the crafted View creation request. The malicious payload is stored server-side in the Splunk instance.
4. Phish the victim: Send a phishing message to a higher-privileged Splunk user (e.g., an admin) containing a link or action that causes their browser to load or interact with the maliciously crafted View.
5. Execute JavaScript: When the victim's browser renders the stored View, the injected JavaScript executes in their browser context, enabling session token theft, credential harvesting, or unauthorized actions on behalf of the victim (Splunk Advisory).

• Network: Unusual POST requests to /manager/launcher/data/ui/views/_new from low-privileged user accounts, particularly containing encoded or obfuscated script tags or path traversal sequences (e.g., ../, %2e%2e%2f) in payload fields.
• Logs: Splunk internal audit logs (_audit index) showing View creation events by users without "admin" or "power" roles; access logs showing unexpected GET requests to newly created Views by high-privileged users shortly after phishing activity.
• File System: Presence of newly created View XML files in the Splunk app directory containing <script> tags or JavaScript event handlers.
• Process/Browser: Reports from users of unexpected browser behavior (redirects, pop-ups, session logouts) after accessing Splunk Views; evidence of session tokens being used from unusual IP addresses following View access.

Splunk has released patched versions addressing this vulnerability. Organizations should upgrade Splunk Enterprise to version 10.2.0, 10.0.3, 9.4.9, or 9.3.9 (or later), and Splunk Cloud Platform to version 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, or 9.3.2411.123 (or later) (Splunk Advisory). As a workaround prior to patching, administrators should restrict View creation permissions to trusted users only and implement security awareness training to reduce phishing susceptibility. Additionally, enforcing strict Content Security Policy (CSP) headers on the Splunk web interface can help limit the impact of any stored XSS payloads.