Vulnerabilities
Splunk Classic Dashboard XSS Allows Low‑Privilege User to Inject JavaScript
A stored XSS flaw in Splunk classic dashboards lets a non‑admin user embed malicious script that runs in another user's browser when the dashboard is opened. The issue exists in pre‑10.2.4, pre‑10.0.7, pre‑9.4.12, and pre‑9.3.13 Enterprise releases and corresponding Cloud Platform versions. Defenders should patch immediately or disable HTML panels.
Splunk Enterprise and Cloud Platform versions below the specified thresholds contain a stored cross‑site scripting vulnerability in classic dashboards. A user with a low‑privilege role (neither admin nor power) can embed malicious JavaScript in an HTML panel. When another user opens the affected dashboard, the script executes in their browser, potentially allowing credential theft or session hijacking.
Affected Versions
- Splunk Enterprise: < 10.2.4, 10.0.7, 9.4.12, 9.3.13
- Splunk Cloud Platform: < 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132
Impact
The flaw is low‑severity but can be leveraged for phishing attacks. The attacker must trick the victim into opening the dashboard, but once executed, the script runs with the victim’s browser context.
Mitigation
- Apply the latest Splunk Enterprise or Cloud Platform patch (10.2.4+, 10.0.7+, 9.4.12+, 9.3.13+).
- Disable HTML panels in classic dashboards if immediate patching is not possible.
- Enforce strict user role policies to prevent low‑privilege accounts from creating dashboards.
Related vulnerabilities
Splunk Classic Dashboards Vulnerability Enables Data Exfiltration via Protocol-Relative URLs
A flaw in Splunk Enterprise and Cloud Platform classic dashboards allows low‑privileged users to redirect victims to external sites using protocol‑relative URLs, bypassing the external‑navigation warning. Affected versions include all releases prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13 (Enterprise) and 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132 (Cloud). Defenders should upgrade, restrict dashboard access, or adjust URL validation.
Read briefing
Splunk Classic Dashboard CSS Vulnerability Enables Data Exfiltration by Low-Privileged Users
Splunk Enterprise and Cloud Platform versions prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13 (Enterprise) and 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132 (Cloud) allow a low‑privileged user to craft a classic dashboard that exfiltrates data from higher‑privileged users’ browsers via external requests. The flaw requires phishing to trigger the victim’s browser. Defenders should patch to the specified versions and restrict dashboard creation permissions.
Read briefing
CVE-2026-0308: Stored XSS Vulnerability Discovered in PAN-OS Web Interface
A low-severity stored cross-site scripting flaw in Palo Alto Networks PAN-OS allows authenticated administrative users to inject and execute malicious JavaScript via the web management interface. Sysadmins managing PA-Series, VM-Series, and Panorama hardware or virtual appliances should review affected versions and apply vendor-supplied patches.
Read briefing
PAN-OS XSS Vulnerabilities (CVE-2026-0279) - Low Severity
Palo Alto Networks identified multiple cross-site scripting (XSS) vulnerabilities in PAN-OS affecting User-ID Authentication Portal, GlobalProtect, and Clientless VPN. Unauthenticated users could potentially inject malicious JavaScript. Palo Alto Networks will automatically upgrade customers; however, proactive upgrades are available.
Read briefing