Splunk Enterprise CVE-2026-76300

Exploitation requires authenticated access to Splunk Enterprise at a low privilege level (CVSS PR:L) over the network; no user interaction is needed and attack complexity is low. The affected versions are Splunk Enterprise 10.2 before 10.2.8, 10.0 before 10.0.11, 9.4 before 9.4.16, and 10.4 before 10.4.4; instances already on or above these fixed releases are not affected. The advisory is a consolidated hardening release for multiple internally discovered CWE-664 issues and does not describe the specific feature, protocol, or configuration that triggers the flaw, so the only confirmed limiting factor is the need for valid low-privileged credentials. Per the vendor, upgrading to a fixed version is the remediation.

This is a genuinely serious but not emergency-level issue whose signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable flaw requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity and availability of the Splunk Enterprise instance. Against that, the exploitation-likelihood signals are low: EPSS is only 0.17% (6th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept or exploit code is referenced (the two references are vendor/NVD advisories only). The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. The result is a high-severity-if-reached vulnerability with currently low observed exploitation pressure, consistent with a vendor-self-disclosed hardening finding rather than an actively weaponized bug. Two data caveats should be stated explicitly: (1) the description is a generic 'internal security review / software hardening' notice under CWE-664 (improper control of a resource through its lifetime) and does NOT describe the trigger mechanism, so the PR:L authentication assumption rests on the CVSS vector, not on described detail; and (2) the 'Information Disclosure' tag conflicts with the CVSS vector, which asserts full C:H/I:H/A:H impact, not disclosure alone - treat the tag as under-stating impact and rely on the CVSS vector.

A low-privileged authenticated user (or an attacker who has obtained valid low-tier Splunk Enterprise credentials) sends crafted requests over the network to the Splunk Enterprise application, abusing improper lifetime control of an internal resource to escalate into full compromise of the instance's data and operation. No user interaction is required and attack complexity is low. No public exploit code is identified at time of analysis, and the precise trigger is not described in the vendor advisory.