{"id":"CVE-2026-76337","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-76337","generatedAt":"2026-10-28T04:03:37.133Z","title":"The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.","description":"In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.","published":"2026-08-19T22:17:18.000Z","lastModified":"2026-08-26T16:16:40.000Z","status":"Analyzed","sourceIdentifier":"psirt@cisco.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-22"],"affected":["splunk/splunk"],"epss":{"score":0.00405,"percentile":0.34599,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0801","tags":["Vendor Advisory"],"source":"psirt@cisco.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76337","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}