---
id: "CVE-2026-76299"
kind: "vulnerability"
aliases: ["CVE-2026-76299"]
title: "Splunk Enterprise: improper access control flaws allow unauthorized actions"
severity: "critical"
cvss: 9.9
epss: 0.00253
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Splunk Enterprise", "fixed": ["10.4.4", "10.2.8", "10.0.11", "9.4.16"], "affected": ">= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["access-control", "cisco", "infrastructure", "self-hosted", "splunk", "splunk-enterprise", "vendor"]
not_affected_if: ["managed-hosting", "version-outside-affected-ranges"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76299", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:26:16+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76299", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: improper access control flaws allow unauthorized actions

Splunk Enterprise has several internally found access control flaws (CWE-284) fixed in a hardening release. The sources do not say which data or actions an attacker gets, only that the flaws are rated critical with a CVSS score of 9.9.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Splunk Enterprise affected >= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16 fixed 10.4.4, 10.2.8, 10.0.11, 9.4.16

## How to check

Check the installed Splunk Enterprise version against the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.

## Fix

Upgrade to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 depending on your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76299
- 2026-10-23T22:26:16+00:00 analyst — Product is Splunk Enterprise (Cisco-owned), not a Cisco network product. Splunk advisory SVD-2026-1008 gives versions and fixes. No exploitation or PoC found; KEV no. Specific flaw details are not published (grouped CWE-284 findings). Auth/vector from CVSS vector only.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76299

## Documents

- [advisory] SVD-2026-1008 Security Hardening in Splunk Enterprise - October 2026 https://advisory.splunk.com/advisories/SVD-2026-1008
- [describes] Splunk Patches Three Critical 9.9 Flaws and Two RCEs https://www.esecurityplanet.com/vulnerabilities/news-splunk-critical-vulnerabilities-october-2026/

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_