Splunk Enterprise: Improper control of a resource through its lifetime

Summary

Splunk Enterprise versions 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8 and 10.4 before 10.4.4 contain a flaw classified as CWE-664, improper control of a resource through its lifetime. Splunk does not disclose the specific flaw, and the CVE is one of several hardening fixes in advisory SVD-2026-1008. According to the vendor's CVSS 3.1 score of 8.8, an attacker with a low-privileged account on the network could affect confidentiality, integrity and availability. No exploitation is known.

Affected

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15
• Splunk Cloud Platform and Universal Forwarder: not listed in the advisory; status unknown, confirm with Splunk support.

Fixed in

• Upgrade to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16 or higher.

Workaround

Unknown. No interim mitigation is documented for this CVE; patching is the only documented remedy.

Exploitation

• No evidence of exploitation in the wild.
• Not listed in CISA KEV.
• CISA SSVC: exploitation none, not automatable.
• No public proof of concept found at the time of research.

Our recommendation

• Inventory all Splunk Enterprise instances and versions, including search heads, indexers and test systems.
• Upgrade affected instances to the fixed versions, starting with systems reachable from the internet or user networks.
• Restrict access to the Splunk web UI (typically port 8000) and management port (8089), and review accounts with low privileges.
• Also patch the companion advisory SVD-2026-1007.
• Recheck NVD, CISA KEV and the Splunk advisory for status changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1008 advisory.splunk.com
• HKCERT Security Bulletin on Splunk products www.hkcert.org
• Canadian Centre for Cyber Security alert AV26-1018 www.cyber.gc.ca
• OpenCVE entry CVE-2026-76300 app.opencve.io
• VulDB entry 425021 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:03.