The vulnerability involves improper neutralization of input during web page generation, a weakness that is categorized under CWE‑707. According to the description, untrusted data can influence how Splunk renders content. An attacker may supply malicious data that, when presented by the web interface, could cause unintended client‑side behavior such as script execution or page manipulation, thereby potentially compromising the confidentiality and integrity of client sessions.

Affected systems are Splunk Enterprise customers using any of the following released versions: 10.4.3, 10.2.7, 10.0.10, or 9.4.15. All of these releases contain the underlying code paths that perform unsafe rendering of user‑supplied data. Users must upgrade to the specified corrected releases or newer to eliminate the flaw.

Risk and exploitability remain significant because the flaw falls under the high‑severity CWE‑707, which is commonly associated with cross‑site scripting. The CVSS score of 9.8 and a low EPSS of <1 % are indicative of a severe flaw that is unlikely to be widely exploited yet retains high impact potential. The vulnerability is not listed in CISA’s KEV catalog. Attackers may exploit the weakness through the web interface by crafting malicious input that is rendered in a user’s browser; depending on the privileges of the target, an unauthenticated or authenticated session may be required. The technique mirrors typical XSS exploitation methods such as injecting code via query parameters or embedded widgets, which are consistent with CWE‑707 violations.