Splunk Enterprise protection mechanism failure allows unauthenticated remote compromise (CVE-2026-76301)

What happened

Cisco's internal security review led to a software hardening release for Splunk Enterprise. CVE-2026-76301 groups several internally discovered vulnerabilities under CWE-693, Protection Mechanism Failure. The CVE record was published on 21 October 2026.

The CVSS 3.1 vector is critical: the weaknesses are reachable over the network with low attack complexity, require no privileges and no user interaction, and have high impact on confidentiality, integrity and availability. The SSVC assessment rates the flaw as automatable with total technical impact.

No exploitation has been reported by CISA or Cisco. There is no CISA KEV entry for this CVE, and the CVE record states that no exploit details have been publicly disclosed.

Who is affected

Affected releases are:

• Splunk Enterprise 10.4 to before 10.4.4
• Splunk Enterprise 10.2 to before 10.2.8
• Splunk Enterprise 10.0 to before 10.0.11
• Splunk Enterprise 9.4 to before 9.4.16

Fixed releases are listed below. If your deployment runs one of these affected version ranges, treat this as a patch priority.

What to do now

1. Upgrade to a fixed release for your branch: Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 or 10.4.4. These are the only fixed versions listed in the CVE record.
2. Prioritise any Splunk Enterprise deployment that is reachable from untrusted networks, since the CVSS vector requires no credentials and no user interaction.
3. If you cannot upgrade immediately, restrict network access to the affected Splunk Enterprise deployments to trusted networks and monitor existing security logs for unexpected connections or account activity. No vendor workaround is listed.

How to detect it

No indicators of compromise are published in the CVE record. Because the CVSS vector is network-based with no privileges required, check whether any Splunk Enterprise deployment is reachable from the internet or other untrusted networks. If it is not reachable, the external exploitation path is reduced.

Beyond the patch

Beyond patching, treat this as an exposure and supply-chain problem. Reachable, unauthenticated services are what exposure management should catch before an advisory like this becomes urgent: Virtual CISO Services (vCISO) can help you inventory and reduce public-facing attack surface. If Splunk Enterprise is supplied or managed by a partner, Supply Chain Defense & Third-Party Risk helps you track which vendor software you run and how quickly fixes are applied.