Splunk Enterprise: Improper neutralization in security hardening batch

Summary

CVE-2026-76284 is a grouped entry in Splunk's batch hardening advisory SVD-2026-1002 and covers several internally found flaws classified under CWE-707 (Improper Neutralization). The vendor has not published the individual flaws, affected components or specific attacker impact. The NVD and CISA ADP record a CVSS 3.1 score of 9.8, but Splunk's advisory lists 9.0 for this CVE and the 9.8 vector is disputed. Treat the issue as critical-range and patch now.

Affected

• Splunk Enterprise 10.4.0 to 10.4.2
• Splunk Enterprise 10.2.0 to 10.2.6
• Splunk Enterprise 10.0.0 to 10.0.9
• Splunk Enterprise 9.4.0 to 9.4.14

Fixed in

• Splunk Enterprise 10.4.3
• Splunk Enterprise 10.2.7
• Splunk Enterprise 10.0.10
• Splunk Enterprise 9.4.15
• Later versions listed in the current Splunk advisory also fix this issue.

Workaround

Unknown. No vendor workaround for this CVE was found; the vendor recommends upgrading.

Exploitation

• Not listed in CISA KEV at the time of research.
• CISA SSVC: exploitation none, automatable yes.
• No public proof of concept or in-the-wild reports known.

Our recommendation

• Inventory all Splunk Enterprise instances and identify those on an affected branch.
• Upgrade to the fixed version for your branch, checking the current Splunk advisory for the target version.
• Check whether any instance is reachable from the internet and restrict access; prioritise exposed instances.
• Monitor the NVD record and CISA KEV, as the CVSS data is still being corrected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1002 advisory.splunk.com
• CISA Vulnrichment GitHub issue 345 (CVSS vector dispute) github.com
• OpenCVE CVE-2026-76284 app.opencve.io
• Canadian Centre for Cyber Security Splunk advisory AV26-1018 www.cyber.gc.ca
• Singapore CSA alert AL-2026-145 www.csa.gov.sg

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:35.