Splunk Enterprise: Improper access control in security hardening release

Summary

Splunk Enterprise contains multiple internally discovered flaws grouped under CVE-2026-76299 and classified as Improper Access Control (CWE-284). The vendor has not published the individual flaws or the concrete attacker impact. According to the NVD mirror, an attacker with a low-privileged authenticated account on the network could affect confidentiality, integrity and availability, with a CVSS 3.1 base score of 9.9 (Critical); the NVD entry itself was still awaiting analysis at the time of research.

Affected

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15
• Splunk Cloud status: Unknown.
• Universal Forwarder: Not listed in the vendor advisory.

Fixed in

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16
• Or higher versions of the same branches.

Workaround

Unknown. No workaround or mitigation is documented for this CVE; the vendor recommends upgrading.

Exploitation

• Splunk's advisory does not mention exploitation.
• CISA SSVC data lists exploitation as none and not automatable; the CVE is not listed in CISA KEV per the NVD mirror.
• No public proof of concept found. Unknown whether exploitation exists outside what could be searched.

Our recommendation

• Identify all Splunk Enterprise instances and their versions, including forwarders, and confirm Splunk Cloud usage with Splunk support.
• Upgrade each branch to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 (or later), starting with instances exposed to the internet or used by many accounts.
• Review low-privileged accounts and restrict access to the management interface.
• Check logs for unusual privileged actions or unexpected data access.
• Monitor the Splunk advisory SVD-2026-1008 for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1008 advisory.splunk.com
• Rescana analysis CVE-2026-76299 www.rescana.com
• OpenCVE CVE-2026-76299 app.opencve.io
• VulDB entry 425023 vuldb.com
• Safeguard.sh analysis CVE-2026-76299 safeguard.sh

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:00.