CVE Intelligence
Analysis AI-assisted

CVE-2026-76284: Splunk Enterprise Improper Neutralization Vulnerabilities (CWE-707)

Splunk fixed several internally identified vulnerabilities in Splunk Enterprise, grouped under the single identifier CVE-2026-76284 by weakness class CWE-707. The record gives a CVSS 3.1 score of 9.8 from the CNA and CISA-ADP and names versions 10.4.3, 10.2.7, 10.0.10 and 9.4.15 as where the issues were addressed. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record covers a group of internally identified vulnerabilities in Splunk Enterprise. The record places them under CVE-2026-76284 and classifies the group as CWE-707 (Improper Neutralization). The vendor advisory SVD-2026-1002 is the only vendor reference listed in the record.

Impact

  • The CVSS 3.1 vector in the record describes a network attack vector, low attack complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability.
  • The CNA and CISA-ADP both give a score of 9.8 (Critical).
  • The SSVC data in the record rates technical impact as total and automatable as yes.
  • The record does not describe the individual flaws, so the concrete consequences for a given deployment are unknown.

Affected products and versions

  • Product in the record: Splunk Splunk Enterprise.
  • Affected ranges in the record: from 10.4 up to but not including 10.4.3; from 10.2 up to but not including 10.2.7; from 10.0 up to but not including 10.0.10; and from 9.4 up to but not including 9.4.15.
  • The description states that fixes were addressed in versions 10.4.3, 10.2.7, 10.0.10 and 9.4.15.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • The SSVC exploitation field is none.
  • The EPSS probability is 0.0033 with a percentile of 0.24318, dated 2026-10-13.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Plan to move Splunk Enterprise deployments to 10.4.3, 10.2.7, 10.0.10 or 9.4.15, or a later release on the same branch, as stated in the description.
  • The record's fixes list is empty, so confirm the exact fixed builds in the vendor advisory before changing production systems.
  • Until patched, limit network exposure of Splunk Enterprise management and data ingestion interfaces to trusted networks and apply least privilege to accounts that can reach them.

Detection guidance

  • Inventory all Splunk Enterprise instances and record their exact versions to find any within the affected ranges.
  • Review logs and monitoring for unexpected administrative actions or anomalous input handling on Splunk instances, and correlate with the vendor advisory guidance.
  • Re-check versions after patching to confirm the update took effect.

Limitations of the available information

  • The record does not list the individual vulnerabilities or their technical details.
  • The CWE record gives the identifier CWE-707 but no name.
  • The source status is Undergoing Analysis, so scores and mappings may change.
  • The advisory page was not retrieved for this analysis, so the fix details and any workarounds it contains are unknown.
  • The NVD and CVE.org pages are listed as sources but their content beyond the record is not reproduced here.

Frequently asked questions

Is CVE-2026-76284 known to be actively exploited?

The record does not list it in the CISA KEV catalog and gives an SSVC exploitation value of none. No confirmed exploitation appears in the sources consulted.

Which Splunk Enterprise versions are fixed?

The description names 10.4.3, 10.2.7, 10.0.10 and 9.4.15 as the versions where the issues were addressed. Confirm the exact builds in the vendor advisory, because the record's fixes list is empty.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.