Splunk Enterprise CVE-2026-76282

Requires network reachability to the Splunk Enterprise management/web interface and a valid low-privilege authenticated account (CVSS PR:L), consistent with abuse of an authenticated feature rather than unauthenticated exposure. No user interaction is needed (UI:N) and scope is unchanged (S:U). Limiting factors: the attacker must first obtain or compromise Splunk credentials/session, and affected deployments must be running versions below 9.4.15, 10.0.10, 10.2.7, or 10.4.3 - patched builds eliminate the issue. The grouped advisory does not name a specific non-default feature toggle, so the condition is primarily the authentication requirement plus a vulnerable version.

Signals are mixed and lean toward moderate real-world priority despite the 8.8 'High' CVSS. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low-level authentication, with full High impact to confidentiality, integrity, and availability - a serious profile for any authenticated Splunk user or compromised account. However, EPSS is very low at 0.15% (4th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is currently no public exploit identified at time of analysis. The vulnerability was internally discovered by the vendor (reported by Cisco/Splunk) rather than observed in attacks, which is consistent with the low exploitation probability. Note a conflict worth flagging: the single 'Information Disclosure' tag understates the scored impact - CVSS claims C:H/I:H/A:H (full compromise), not disclosure alone, and CWE-664 (Improper Control of a Resource Through its Lifetime) is a generic grouping weakness; the terse, grouped advisory means the precise exploitation mechanics are not publicly detailed. Net: a patch-promptly item for Splunk operators (authenticated attack surface, full impact) but not an emergency given no exploitation evidence and a low EPSS.

An attacker who already holds low-privilege authenticated access to a Splunk Enterprise instance (e.g., a low-tier user account or stolen session) sends crafted requests over the network that abuse improper resource lifetime handling. Because no user interaction is required and complexity is low, the attacker can escalate impact to read sensitive data, alter data/configuration, and disrupt availability. No public PoC exists, so exploitation would require independent development against the vendor-described weakness.