Splunk Enterprise: Protection mechanism failure in security hardening release

Summary

CVE-2026-76301 is a protection mechanism failure (CWE-693) in Splunk Enterprise, addressed in the October 2026 security hardening release SVD-2026-1008. The NVD entry rates it 9.8 (critical) with a network-reachable vector that requires no privileges or user interaction, but Splunk's advisory lists this CVE with a highest CVSS score of 7.6, so the scores differ. The specific flaws and attack path have not been published, so the exact conditions for exploitation are unknown.

Affected

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15
• Splunk Cloud: Unknown (not listed in the advisory)
• Universal Forwarder: Unknown (not listed in the advisory)

Fixed in

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16
• Or any later version in these branches

Workaround

No workaround documented for this CVE.

• Interim measure (general hardening advice, not from Splunk): restrict network access to the Splunk web and management interfaces.

Exploitation

• CISA KEV: not listed.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public exploitation reported and no indicators of compromise published.
• No public proof of concept known.

Our recommendation

• Inventory all Splunk Enterprise instances and versions, including forwarders and hosted or managed instances.
• Upgrade each instance to the fixed version for its branch, starting with internet-facing hosts.
• Verify that Splunk web and management ports are not exposed to the internet or untrusted networks.
• Review logs for unusual administrative or login activity before patching.
• Recheck NVD and the Splunk advisory for changes, including the CVSS score.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1008 advisory.splunk.com
• OpenCVE record CVE-2026-76301 app.opencve.io
• HKCERT security bulletin on Splunk products www.hkcert.org
• Rescana analysis of Splunk Enterprise hardening release www.rescana.com
• Safeguard.sh analysis of Splunk Enterprise CVEs safeguard.sh
• Canadian Centre for Cyber Security Splunk advisory www.cyber.gc.ca

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:04.