The vulnerability allows a user who holds the power role in Splunk Enterprise to craft a malicious ui‑tour knowledge object that matches an auto‑tour page name and share it at the application level. When another authenticated user navigates to a standard Splunk Web page, the untrusted tour content is rendered, enabling the injected JavaScript to run in the victim’s browser. This stored cross‑site scripting can reveal session data, steal credentials, or otherwise compromise the integrity of the victim’s permissions.

Splunk Enterprise installations running any version older than 10.4.2, 10.2.6, 10.0.9, or 9.4.14 are affected. The flaw requires that Splunk Web be enabled and that an attacker possess the power role to create the malicious tour object; users without that role or when Splunk Web is disabled are not exposed.

The CVSS score of 7.3 indicates a high severity of the vulnerability. The exploit requires an authenticated attacker who can create a malicious ui‑tour object and a victim who is logged into Splunk Web, so the attack vector is inferred to be authenticated web‑based XSS. EPSS information is unavailable and the issue is not listed in CISA’s KEV catalog. While the impact is limited to users visiting affected pages, the ability to execute code under the victim’s credentials poses a significant threat to data confidentiality and system integrity.