CVE-2015-7604: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk L...

Security readout for executives and security teams

CVE-2015-7604 is a cross-site scripting issue in Splunk Web affecting Splunk Enterprise and Splunk Light 6.2.x before 6.2.6. A remote attacker could inject script or HTML through unspecified paths. Business risk depends on who can reach Splunk Web and whether exposed users have privileged Splunk access. Exposure is most likely where legacy Splunk Enterprise or Splunk Light 6.2.x instances are still running Splunk Web below 6.2.6, especially if reachable by broad internal users or the internet. Treat this as a cleanup priority for any remaining legacy Splunk 6.2.x systems. It is not listed as known exploited in the supplied data, but Splunk Web often handles sensitive operational visibility, making administrator browser compromise a meaningful risk. Mitigation focus: Upgrade affected Splunk Enterprise 6.2.x deployments to 6.2.6 or later.; Upgrade affected Splunk Light 6.2.x deployments to 6.2.6 or later.; Review Splunk’s advisory for any product-specific guidance or supported upgrade path..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.