1. Home
  2. CVE Database
  3. CVE-2026-76337
MEDIUM · 5.3

CVE-2026-76337

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible becau...

Vulnerability Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
SplunkSplunk>= 9.4.0, < 9.4.14

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2026-76337?

CVE-2026-76337 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible becau...

How severe is CVE-2026-76337?

CVE-2026-76337 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-76337?

Check the references section above for vendor advisories and patch information. Affected products include: Splunk Splunk.