Splunk Enterprise improper neutralization allows unauthenticated network compromise (CVE-2026-76284)

What happened

CVE-2026-76284 is an improper neutralization weakness (CWE-707) in Splunk Enterprise. The CVSS 3.1 rating is critical with a score of 9.8. According to the vector, the vulnerability is reachable over a network, has low attack complexity, requires no privileges and no user interaction, and a successful exploit can have high impact on confidentiality, integrity and availability.

Splunk addressed multiple internally identified vulnerabilities in fixed releases 10.4.3, 10.2.7, 10.0.10 and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration, with one CVE identifier assigned to each group.

The CVE record states no public exploitation and no public disclosure; the flaw is not listed in CISA's KEV catalogue.

Who is affected

Affected installations are Splunk Enterprise 10.4 to before 10.4.3, 10.2 to before 10.2.7, 10.0 to before 10.0.10 and 9.4 to before 9.4.15. Splunk Enterprise is the only product listed in the CVE record, and the record does not describe typical deployment roles. If you run Splunk Enterprise, check which release line you are on.

What to do now

1. Inventory Splunk Enterprise instances and identify those on 10.4 to before 10.4.3, 10.2 to before 10.2.7, 10.0 to before 10.0.10 or 9.4 to before 9.4.15.
2. Upgrade each instance to the fixed version for its release line: Splunk Enterprise 10.4.3, 10.2.7, 10.0.10 or 9.4.15.
3. Prioritise instances reachable from the internet or other untrusted networks, because no authentication and no user interaction are required.
4. If you cannot patch immediately, restrict access to Splunk Enterprise interfaces to trusted management networks. The CVE record does not list a workaround.

How to detect it

Check the exact version of every Splunk Enterprise instance, concentrating on those reachable from untrusted networks, and compare it against the fixed releases. The CVE record does not publish indicators of compromise, so exposure is best identified by finding unpatched instances that are reachable without authentication.

Beyond the patch

Because this flaw is reachable over a network without credentials, the main risk is an unmanaged or internet-facing Splunk Enterprise instance. Virtual CISO Services (vCISO) helps you keep an inventory and governance process for externally reachable services. Tracking which suppliers run Splunk Enterprise, and how quickly they patch, is part of Supply Chain Defense & Third-Party Risk.