Splunk Enterprise: Improper control of a resource through its lifetime

Summary

Splunk Enterprise contains a flaw classified as CWE-664 (improper control of a resource through its lifetime), part of a batch of internally discovered vulnerabilities fixed in a security hardening release. The specific flaw, the affected component and its exact impact are not disclosed. The CVSS 3.1 score is 8.8 (high), with a network attack vector, low privileges required, no user interaction and high impact on confidentiality, integrity and availability. Exploitation is not known to date.

Affected

• Splunk Enterprise 10.4.0 to 10.4.2
• Splunk Enterprise 10.2.0 to 10.2.6
• Splunk Enterprise 10.0.0 to 10.0.9
• Splunk Enterprise 9.4.0 to 9.4.14
• The advisory applies these ranges to the batch as a whole; per-CVE ranges are not published, so all branches should be treated as in scope.

Fixed in

• Splunk Enterprise 10.4.3
• Splunk Enterprise 10.2.7
• Splunk Enterprise 10.0.10
• Splunk Enterprise 9.4.15
• Newer releases (for example 10.4.4, 10.2.8, 10.0.11, 9.4.16 from advisory SVD-2026-1008) are not confirmed to cover this CVE; use the latest release for new deployments.

Workaround

Unknown. No vendor workaround has been published; the vendor recommends upgrading.

Exploitation

• No known exploitation in the wild.
• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS below 1%.
• No public proof of concept reported.

Our recommendation

• Inventory all Splunk Enterprise instances and their versions.
• Upgrade to 10.4.3, 10.2.7, 10.0.10 or 9.4.15 (or higher) as soon as possible.
• Restrict access to the web (8000) and management (8089) interfaces to trusted networks only.
• Review authentication accounts and monitor logs for unusual activity until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk advisory SVD-2026-1002 advisory.splunk.com
• OpenCVE record (NVD, SSVC, KEV, EPSS) app.opencve.io
• Canadian Centre for Cyber Security alert AV26-1018 www.cyber.gc.ca
• HKCERT security bulletin www.hkcert.org
• SecurityOnline analysis securityonline.info
• Rapid7/Vulners aggregation vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:15.