CVE-2026-76302
Splunk Enterprise security hardening fixes multiple improper neutralization flaws (CVE-2026-76302)
Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 before fixed builds are affected. A low-privileged network attacker can exploit multiple improper neutralization flaws for high impact on confidentiality, integrity and availability. Update to Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 or 10.4.4.
What happened
The CVE record for CVE-2026-76302 was published on 21 October 2026. It describes a Cisco security hardening release for Splunk Enterprise that addresses multiple internally discovered vulnerabilities. The issues are grouped under CWE-707, improper neutralization. The CVSS 3.1 base score is 9.9 (critical), with a vector of network attack, low attack complexity, low privileges and no user interaction. A successful attacker could cause a scope change and high impact on confidentiality, integrity and availability.
The CVE record does not list exploitation, and the issues have not been publicly disclosed. The SSVC assessment records exploitation as none, automatable as no and technical impact as total. EPSS is 0.2 percent, with a percentile of 8. There is no CISA KEV entry for this CVE.
The advisory groups the flaws rather than describing separate exploit paths or individual mechanics.
Who is affected
Affected product: Splunk Enterprise. The affected release lines are 10.4 to before 10.4.4, 10.2 to before 10.2.8, 10.0 to before 10.0.11 and 9.4 to before 9.4.16. If your deployment is on any of these branches, it is affected. No other affected products are listed in the CVE record.
What to do now
- Install the fixed build for your release branch: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16.
- The advisory does not publish a workaround, so patching is the only stated remediation.
- Confirm that every Splunk Enterprise instance in your environment is updated. Because the CVSS vector includes network access and low privileges, restrict access to Splunk Enterprise interfaces to trusted hosts while patching is in progress.
Beyond the patch
Patch first. Beyond this fix, the fact to carry forward is that your exposure window is set by how quickly you find and update every affected Splunk Enterprise instance — a supplier patch-cycle problem. Supply Chain Defense & Third-Party Risk tracks the software you run and vendor fix cadence so updates like this do not slip. If your organisation reports under NIS2 / DORA frameworks, keep this dependency in your third-party risk register.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | 10.4 – < 10.4.4 10.2 – < 10.2.8 10.0 – < 10.0.11 9.4 – < 9.4.16 | 10.4.4 10.2.8 10.0.11 9.4.16 |