Splunk Enterprise improper access control allows low-privileged remote compromise (CVE-2026-76299)

What happened

Cisco's October 2026 security hardening release for Splunk Enterprise addresses multiple internally discovered weaknesses tracked as CVE-2026-76299 and classified as CWE-284, improper access control. The vulnerability is rated 9.9, critical, under CVSS 3.1.

An attacker who can reach the product over the network and has only a low-privileged account can exploit the weaknesses without any action from a victim. The impact is high across confidentiality, integrity and availability, and the changed scope means other components beyond the vulnerable one can also be affected.

The CVE record does not report active exploitation or public disclosure of this issue.

Who is affected

Splunk Enterprise is the affected product. The affected ranges are 10.4 to before 10.4.4, 10.2 to before 10.2.8, 10.0 to before 10.0.11, and 9.4 to before 9.4.16. This covers the 9.4, 10.0, 10.2 and 10.4 deployment lines until the fixed builds are applied. If you run one of these release lines without the corresponding fixed build, treat the instance as affected and plan the upgrade.

What to do now

1. Verify the current version of every Splunk Enterprise instance against the affected ranges: 10.4 to before 10.4.4, 10.2 to before 10.2.8, 10.0 to before 10.0.11, and 9.4 to before 9.4.16.
2. Upgrade each affected instance to the matching fixed release: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, or 9.4.16.
3. Until the upgrade is complete, restrict access to Splunk Enterprise to trusted users and networks, because the flaw involves improper access control. No vendor workaround is listed.
4. After upgrading, confirm that each host reports the fixed version and re-run any access-control checks performed before the change.

Beyond the patch

This critical fix is a reminder that the software you rely on has its own patch cycle, and you need to know where every Splunk Enterprise instance sits and how quickly the vendor closes a serious access control flaw. Supply Chain Defense & Third-Party Risk maps the vendor software in your estate and tracks remediation timelines, so a 9.9 hardening release becomes a controlled update rather than an emergency. That same inventory also supports the supplier-dependency evidence required by NIS2 / DORA frameworks.