Splunk Enterprise CVE-2026-76301

The available description does not name any specific feature, protocol, configuration setting, or deployment mode - it is a grouped hardening release under CWE-693 (protection mechanism failure) with the trigger not disclosed. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication, no user interaction, and low attack complexity against network-reachable Splunk Enterprise, i.e. 'no special conditions' per the rating alone. Limiting factors: exploitation requires network reachability to the Splunk Enterprise management/service interface (typically not internet-exposed in well-segmented deployments), and only versions below the fixed releases (10.2.8, 10.4.4, 10.0.11, 9.4.16) are affected; because the mechanism is undisclosed, whether a non-default configuration is required cannot be confirmed from available sources.

Signals conflict and must be weighed carefully. The vendor-supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a severe, remotely reachable flaw requiring no authentication or user interaction, and the vuln.today Decision label is 'act_now' - so for an organization running affected Splunk Enterprise, this should be treated as high-priority patching. However, EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is currently no evidence of real-world or imminent mass exploitation. The critical caveat is mechanism: this CVE is a bundled 'software hardening release' covering multiple internally discovered issues grouped under CWE-693 (protection mechanism failure), and the description provides NO technical detail on how the flaw is triggered - the AV:N/AC:L/PR:N rating is vendor-asserted and cannot be independently verified from the available text. There is also a labeling tension: the 'Information Disclosure' tag understates the vector, since the CVSS claims full confidentiality, integrity AND availability impact (C:H/I:H/A:H), not read-only disclosure. Net: prioritize patching on the strength of the 9.8/act_now rating and Splunk's wide deployment, but recognize the low EPSS and absent exploit evidence suggest this is a proactive fix rather than an actively weaponized threat.

Per the vendor CVSS vector, a remote attacker with network reachability to an affected Splunk Enterprise instance and no credentials could exploit a protection-mechanism failure to compromise confidentiality, integrity and availability. The exact trigger is not described in the available sources - the advisory is a grouped hardening release, not a mechanism disclosure. No public exploit code or PoC reference was identified at the time of analysis.