The CVSS 6.7 score for CVE-2026-76328 fundamentally mischaracterizes the actual risk. The vulnerability is not merely a stored SPL injection in a dashboard — it is a cross-user privilege escalation that exploits Splunk's PDF export pipeline to re-execute stored search queries under a victim's authenticated session. A user with Power role privileges can inject malicious SPL into a dashboard, and when any user exports that dashboard to PDF, the injected SPL executes with the exporter's full permissions. This transforms a routine reporting feature into an authenticated code execution vector.
The power role requirement does not meaningfully reduce severity — it actually confirms the danger. Power role is standard analyst access in most Splunk deployments, not a privileged administrative threshold. Organizations that treat 'requires power role' as a security boundary are relying on an incidental workflow constraint that was never designed as a security control.
The most critical operational impact is audit trail contamination. Splunk logs PDF exports as routine user actions without flagging that stored SPL re-executed under the victim's credentials. Your security monitoring will see nothing anomalous because the attack IS the normal workflow. If you rely on Splunk logs for detection or compliance evidence, you cannot distinguish between legitimate exports and privilege escalation.
Immediate actions: First, audit your Splunk deployment for automated PDF export workflows — scheduled reports, analyst morning briefings, compliance exports that run under service accounts or elevated permissions. These are your trigger points. Second, review who holds Power role and treat that as insider threat surface, not baseline access. Third, disable PDF export for dashboards containing SPL-generating searches if feasible, or route PDF exports through a sandboxed intermediary until patches are applied. The affected versions span 9.4.x through 10.4.x — patch all of them, but understand that the patch addresses this specific vector while the underlying architectural assumption that PDF export is a content-delivery mechanism rather than a code-execution context likely persists in adjacent features.