EUVD-2026-94586
GHSA-fw3v-w3rf-g749
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Splunk Enterprise endpoint
-
ExploitSend crafted unauthenticated network request
-
ExecutionTrigger CWE-710 coding-standards flaw
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are stated - remote unauthenticated exploitation over the network against affected Splunk Enterprise instances (versions below 9.4.15, 10.0.10, 10.2.7, and 10.4.3). The practical limiting factor is network reachability to the Splunk service (management port/web interface), which in many enterprise deployments is restricted to internal networks or placed behind access controls rather than internet-exposed. Note that the advisory provides no feature/configuration prerequisites because it is a generic CWE-710 grouping; whether a non-default mode or specific component is required cannot be confirmed from available data and should be checked against SVD-2026-1002. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a critical, network-reachable, unauthenticated flaw with full confidentiality, integrity, and availability impact and low attack complexity - on paper a top-priority issue. However, the real-world signals temper this: EPSS is only 0.14% (3rd percentile), there is no CISA KEV listing and no public exploit identified, indicating no evidence of exploitation or weaponization at time of analysis. A notable tension exists between the data points: the CVE is tagged 'Information Disclosure' yet the CVSS vector asserts High integrity AND availability impact, and the description is a generic CWE-710 ('Improper Adherence to Coding Standards') grouping that provides no technical specifics - so the 9.8 score cannot be independently corroborated from the description and should be verified against the Splunk SVD-2026-1002 advisory. No SSVC decision data was provided. Net assessment: patch promptly given the critical vendor rating and unauthenticated network vector, but current evidence points to a theoretical/not-yet-exploited risk rather than active mass exploitation; the low EPSS and absence of POC suggest this is not yet an urgent, in-the-wild threat. |
| Exploit ScenarioDerived | An attacker with network access to an exposed Splunk Enterprise instance sends a crafted request to the affected component and, with no authentication or user interaction required (per CVSS AV:N/PR:N/UI:N), triggers the underlying coding-standards defect to compromise data confidentiality, integrity, and availability. Because the advisory groups multiple issues under one generic CWE-710 identifier without technical detail, the precise trigger is not publicly specified. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Splunk Enterprise installations at versions below 9.4.15, 10.0.10, 10.2.7, and 10.4.3 are affected by a coding-standard defect that the vendor rates at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated network attacker could in principle achieve full loss of confidentiality, integrity, and availability. The issue is one of several internally identified findings that Splunk grouped under CWE-710 (Improper Adherence to Coding Standards) and documents in advisory SVD-2026-1002; because the advisory groups multiple defects by weakness class, it does not enumerate the specific component, feature, or configuration prerequisite involved, so the exact attack path cannot be confirmed from available data. Practical risk is presently tempered: EPSS is only 0.14 percent (3rd percentile) and there is no public exploit identified at time of analysis, with no CISA KEV listing indicating confirmed active exploitation; the dominant exposure factor is network reachability to the Splunk web interface or management port, which in many enterprise deployments is restricted to internal networks rather than internet-exposed.
RemediationAI
Upgrade Splunk Enterprise to the fixed build for your release train: 9.4.15, 10.0.10, 10.2.7, or 10.4.3, as listed in vendor advisory SVD-2026-1002 (https://advisory.splunk.com/advisories/SVD-2026-1002), which is the authoritative source for the specific component fixes grouped under CVE-2026-76285. Because the advisory does not identify a feature toggle or configuration prerequisite, there is no confirmed settings-based workaround, so the reliable remediation is applying the patched release; review the full SVD-2026-1002 text to confirm whether any component-specific configuration hardening is recommended alongside the upgrade. In the interim, treat network reachability as the primary compensating control: restrict access to the Splunk web interface and the management/REST service to trusted administrative networks using host firewalls, security groups, reverse-proxy allowlists, or ingress ACLs, and avoid exposing the instances directly to the internet - the trade-off is reduced administrative and remote-user access, which must be balanced against operational need. Where remote access is required, terminate it through an authenticated, TLS-enforcing gateway or VPN and remove or disable unnecessary apps, add-ons, and REST endpoints that extend the reachable attack surface; disabling or removing add-ons can break dependent dashboards, alerts, and data inputs, so stage the change. Finally, monitor Splunk audit and _internal logs for anomalous requests to the management port or web interface, since the low EPSS score and absence of a public exploit mean targeted scanning or exploitation attempts would likely appear as unusual access patterns rather than recognizable exploit signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-710, Improper Adherence to Coding Standards, a broad meta-weakness indicating that the underlying defects arise from development practices that deviated from secure coding requirements rather than from a single specific memory-safety or injection flaw. Splunk assigned one CVE identifier per CWE group, so CVE-2026-76285 represents a bundle of internally discovered issues sharing that weakness classification across Splunk Enterprise builds, which is why the public description and the advisory do not describe a discrete exploitable primitive. The affected technology is Splunk Enterprise, the commercial data-ingestion, indexing, and search platform confirmed by the CPE string cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*; Splunk Enterprise normally exposes a web interface and a REST/management service, both of which are reachable over the network and are the plausible surfaces implied by the AV:N/PR:N vector. The accompanying tag set labels this entry as an Information Disclosure issue, suggesting that at least part of the grouped findings concerns exposure of data that should not be accessible, while the CVSS vector's high integrity and availability metrics indicate the group as a whole extends beyond read-only exposure. Because the fix is distributed across four maintenance releases (9.4.15, 10.0.10, 10.2.7, and 10.4.3), remediation requires identifying which specific component changes in SVD-2026-1002 apply to a given deployment.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description lacks technical detail, so metrics follow the vendor vector: network unauthenticated (AV:N/PR:N/UI:N) with low complexity and full CIA impact; low confidence pending advisory detail.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
Executive ViewAI
Splunk Enterprise deployments below versions 9.4.15, 10.0.10, 10.2.7, and 10.4.3 carry a critical unauthenticated network compromise risk that could expose the confidentiality, integrity, and availability of security telemetry and operational data. Because Splunk is often central to security monitoring and incident response, a successful attack could blind detection, corrupt investigations, and expose sensitive enterprise data. No public exploit identified at time of analysis and EPSS is low, but the CVSS 9.8 severity and network-exposed nature warrant immediate leadership attention and patch prioritization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB