Splunk Enterprise: Improper neutralization in security hardening release

Summary

Splunk Enterprise versions 10.4 before 10.4.4, 10.2 before 10.2.8, 10.0 before 10.0.11 and 9.4 before 9.4.16 contain internally discovered flaws grouped under CWE-707 (Improper Neutralization). The advisory does not describe the individual flaws, so the exact attack path is unknown. CISA's enrichment rates the CVE as network-reachable, low complexity, low privileges required, no user interaction, with high impact on confidentiality, integrity and availability. Splunk's own score is 9.9 (Critical).

Affected

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15
• Splunk Cloud: Unknown.

Fixed in

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16

Workaround

Unknown. Splunk lists no workaround or mitigation for SVD-2026-1008.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalogue.
• Public proof of concept: Unknown.

Our recommendation

• Identify all Splunk Enterprise instances and their versions.
• Upgrade to the fixed versions listed above.
• Prioritise internet-exposed and shared-admin installations.
• Ask Splunk whether Splunk Cloud is affected.
• Review SVD-2026-1007 for interim mitigations, without assuming they apply to this CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1008 advisory.splunk.com
• CVE-2026-76302 on cvefeed.io cvefeed.io
• Rescana: Splunk Enterprise security hardening October 2026 www.rescana.com
• OpenCVE: CVE-2026-76302 app.opencve.io
• HKCERT security bulletin on Splunk products www.hkcert.org
• Safeguard.sh: Splunk Enterprise CVE-2026-76299 and CVE-2026-76302 safeguard.sh

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:58.