{"id":"CVE-2026-76302","kind":"vulnerability","aliases":["CVE-2026-76302"],"related":[],"title":"Splunk Enterprise: hardening release fixes several critical internal flaws","description":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.","summary":"Cisco's Splunk Enterprise has multiple internally found flaws tracked under CWE-707 (improper neutralization) that were fixed in a hardening release. The sources do not say what an attacker can actually do with them.","severity":"critical","cvss":9.9,"epss":0.00378,"exploited":false,"exploited_at":null,"products":[{"name":"Splunk Enterprise","fixed":["10.4.4","10.2.8","10.0.11","9.4.16"],"affected":">= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","infrastructure","self-hosted","splunk","splunk-enterprise","vendor"],"not_affected_if":["splunk-cloud","version-outside-affected-ranges"],"how_to_check":"Run splunk version on the Splunk host and compare it to the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.","fix":"Upgrade to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16, matching your release line.","status":"open","published_at":"2026-10-21T23:17:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:41+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T22:32:41Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16, matching your release line.","reach":"unknown","title":"Splunk Enterprise: hardening release fixes several critical internal flaws","impact":"high","summary":"Cisco's Splunk Enterprise has multiple internally found flaws tracked under CWE-707 (improper neutralization) that were fixed in a hardening release. The sources do not say what an attacker can actually do with them.","category":"vendor","who_cares":["splunk-enterprise","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources only say the flaws relate to improper neutralization","analyst_note":"Check Cisco's Splunk security advisory for the specific attack vector, required privileges and whether the flaws are network-reachable; the NVD entry gives only the CWE and the fixed versions.","how_to_check":"Run splunk version on the Splunk host and compare it to the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.","needs_analyst":true,"not_affected_if":["splunk-cloud","version-outside-affected-ranges"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00056,"input_tokens":3092,"output_tokens":502,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Cisco advisory and affected product for CVE-2026-76302 via the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-76302) and Cisco PSIRT; the description is vague and the CVSS 9.9 score needs its vector confirmed.","search":"'-2026':11A,14A,100C '-707':40B,117C '-76302':12A,15A,101C 'actual':59B 'address':90C 'attack':57B 'cisco':18B,28B,63C,73C 'commit':66C 'common':112C 'comprehens':77C 'conduct':75C 'critic':7A 'cve':10A,13A,99C 'cwe':39B,115C,116C 'discov':93C 'enterpris':2A,26B,31B 'enterprise':17A 'enumer':114C 'fix':5A,45B 'flaw':9A,36B 'found':35B 'group':109C 'harden':3A,48B,87C 'host':22B 'improp':41B,105C 'infrastructur':19B 'intern':8A,34B,78C,92C 'multipl':33B,91C 'neutral':42B,106C 'ongo':65C 'part':61C 'proactiv':68C 'product':71C 'qualiti':72C 'relat':103C 'releas':4A,49B,88C 'result':83C 'review':80C,82C 'say':54B 'secur':69C,79C 'self':21B 'self-host':20B 'sever':6A 'softwar':86C 'sourc':51B 'splunk':1A,16A,23B,25B,30B 'splunk-enterpris':24B 'track':37B,97C 'vendor':27B 'vulner':94C,96C 'weak':113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76302","severity":null,"published_at":"2026-10-21T23:17:28+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76302:220","url":null,"severity":null,"published_at":"2026-10-23T22:25:10+00:00","modified_at":"2026-10-23T22:25:10+00:00","first_seen_at":"2026-10-23T22:25:10+00:00","fetched_at":"2026-10-23T22:25:10+00:00","note":"Product is Splunk Enterprise (Cisco-owned), per Splunk SVD-2026-1008 (primary). Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H confirmed. Advisory gives no technical detail; no exploitation or PoC found. Sibling CVEs: 76299 (9.9), 76300, 76301 in same advisory."},{"source":"epss","external_id":"CVE-2026-76302","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76302","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1428,"url":"https://advisory.splunk.com/advisories/SVD-2026-1008","title":"SVD-2026-1008 Security Hardening in Splunk Enterprise - October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1429,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76302","title":"CVE Record CVE-2026-76302","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}