Splunk Enterprise CVE-2026-76299

Requires a low-privileged but authenticated Splunk Enterprise account (CVSS PR:L), reachable over the network with no user interaction. The advisory does not name a specific feature, protocol, SAPI, or configuration setting, so the exact trigger is not described in the available sources. Limiting factors: exploitation is gated by needing valid (even if low-privilege) authentication to the Splunk Enterprise instance and by running an affected version - Splunk Enterprise 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, or 10.4 before 10.4.4; instances already upgraded to those fixed releases are not exploitable. No non-default configuration is stated as required.

Signals point in a consistently high-priority direction, though they rest on thin vendor disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw that needs only a low-privileged account, requires no user interaction, and crosses a security scope boundary with total confidentiality, integrity, and availability impact - the profile of a privilege-escalation or authentication/access-control bypass. The vuln.today decision label is act_now, and a vendor patch is available. However, key corroborating signals are MISSING rather than conflicting: no EPSS exploitation probability is provided, the input does not list CISA KEV status (treated as not listed), and there is no PoC or exploit reference. Therefore exploitation is characterized as 'no public exploit identified at time of analysis' - the high score reflects severity and potential, not confirmed real-world abuse. One data caveat: the description is verbatim Cisco 'internal security hardening review' boilerplate, yet the CPE, affected-version list, references, and advisory (Splunk SVD-2026-1008) all identify the product as Splunk Enterprise; Cisco owns Splunk, so this is consistent, but the description adds no technical detail about the actual Splunk flaw. Net: a credible high-priority issue warranting prompt patching per the act_now label, with the caveat that its urgency is driven by CVSS severity and vendor prioritization rather than observed exploitation.

An attacker holding a low-privileged authenticated Splunk Enterprise account sends network requests that abuse an improper access-control weakness (CWE-284) to reach functionality or data outside their authorization boundary, consistent with the scope-change and authentication-bypass characterization. Because the advisory does not describe the trigger, the precise request or feature abused is not detailed in available sources. No public exploit code or PoC reference is provided at the time of analysis.