EXPOSURES › CVE-2026-76311
CVE-2026-76311
CRITICALUnauthenticated users with embedded report tokens can download dispatch archives and access all data on Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
This vulnerability allows unauthenticated attackers to access all data and affect system integrity by exploiting exposed session material in embedded report dispatch archives. DIB organizations must ensure Splunk Enterprise is patched to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 and above to prevent data exposure and compliance violations under NIST 800-171. The failure stems from an authorization flow that does not block dispatch archive download requests before data is sent.
Shame score — The vulnerability allows unauthenticated data access and system integrity compromise, which is avoidable through patching and represents a significant compliance risk for DIB organizations.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation.
| PRODUCT | STATUS |
|---|---|
| Splunk Cloud Platform for FedRAMP High Splunk |
In Process |
| Splunk Cloud Platform for FedRAMP Moderate Splunk |
Authorized |