{"id":"CVE-2026-76299","kind":"vulnerability","aliases":["CVE-2026-76299"],"related":[],"title":"Splunk Enterprise: improper access control flaws allow unauthorized actions","description":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.","summary":"Splunk Enterprise has several internally found access control flaws (CWE-284) fixed in a hardening release. The sources do not say which data or actions an attacker gets, only that the flaws are rated critical with a CVSS score of 9.9.","severity":"critical","cvss":9.9,"epss":0.00253,"exploited":false,"exploited_at":null,"products":[{"name":"Splunk Enterprise","fixed":["10.4.4","10.2.8","10.0.11","9.4.16"],"affected":">= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["access-control","cisco","infrastructure","self-hosted","splunk","splunk-enterprise","vendor"],"not_affected_if":["managed-hosting","version-outside-affected-ranges"],"how_to_check":"Check the installed Splunk Enterprise version against the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.","fix":"Upgrade to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 depending on your release line.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:44+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:32:44Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 depending on your release line.","reach":"unknown","title":"Splunk Enterprise: improper access control flaws allow unauthorized actions","impact":"high","summary":"Splunk Enterprise has several internally found access control flaws (CWE-284) fixed in a hardening release. The sources do not say which data or actions an attacker gets, only that the flaws are rated critical with a CVSS score of 9.9.","category":"vendor","who_cares":["splunk-enterprise","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown access control bypass; exact data or action exposure not stated by sources","analyst_note":"Check the Cisco Splunk security advisory for the specific flaws, required privileges and network exposure; the NVD text does not say.","how_to_check":"Check the installed Splunk Enterprise version against the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.","needs_analyst":true,"not_affected_if":["managed-hosting","version-outside-affected-ranges"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000549,"input_tokens":3094,"output_tokens":479,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected Cisco product, versions and fixed release from Cisco's security advisory linked from the NVD entry, and confirm attack vector and auth requirements.","search":"'-2026':11A,14A,112C '-284':41B,130C '-76299':12A,15A,113C '9.9':71B 'access':4A,19B,37B,118C 'access-control':18B 'action':9A,55B 'address':102C 'allow':7A 'attack':57B 'cisco':21B,75C,85C 'commit':78C 'common':125C 'comprehens':89C 'conduct':87C 'control':5A,20B,38B,119C 'critic':65B 'cve':10A,13A,111C 'cvss':68B 'cwe':40B,128C,129C 'data':53B 'discov':105C 'enterpris':2A,29B,32B 'enterprise':17A 'enumer':127C 'fix':42B 'flaw':6A,39B,62B 'found':36B 'get':58B 'group':122C 'harden':45B,99C 'host':25B 'improp':3A,117C 'infrastructur':22B 'intern':35B,90C,104C 'multipl':103C 'ongo':77C 'part':73C 'proactiv':80C 'product':83C 'qualiti':84C 'rate':64B 'relat':115C 'releas':46B,100C 'result':95C 'review':92C,94C 'say':51B 'score':69B 'secur':81C,91C 'self':24B 'self-host':23B 'sever':34B 'softwar':98C 'sourc':48B 'splunk':1A,16A,26B,28B,31B 'splunk-enterpris':27B 'track':109C 'unauthor':8A 'vendor':30B 'vulner':106C,108C 'weak':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76299","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76299:221","url":null,"severity":null,"published_at":"2026-10-23T22:26:16+00:00","modified_at":"2026-10-23T22:26:16+00:00","first_seen_at":"2026-10-23T22:26:16+00:00","fetched_at":"2026-10-23T22:26:16+00:00","note":"Product is Splunk Enterprise (Cisco-owned), not a Cisco network product. Splunk advisory SVD-2026-1008 gives versions and fixes. No exploitation or PoC found; KEV no. Specific flaw details are not published (grouped CWE-284 findings). Auth/vector from CVSS vector only."},{"source":"epss","external_id":"CVE-2026-76299","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76299","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1428,"url":"https://advisory.splunk.com/advisories/SVD-2026-1008","title":"SVD-2026-1008 Security Hardening in Splunk Enterprise - October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1439,"url":"https://www.esecurityplanet.com/vulnerabilities/news-splunk-critical-vulnerabilities-october-2026/","title":"Splunk Patches Three Critical 9.9 Flaws and Two RCEs","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}