Splunk Enterprise CVE-2026-76302

Exploitation requires a network-reachable Splunk Enterprise instance and a valid low-privilege authenticated account (CVSS PR:L) - it is NOT unauthenticated; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, endpoint, or configuration that triggers the improper neutralization is not described in the available sources, so no feature-level precondition can be named. Limiting factors: the attacker must first possess or obtain low-tier Splunk credentials, and only the listed version branches are affected (Splunk Enterprise 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, and 10.4 before 10.4.4); instances already on or above those fixed versions are not exploitable.

This is a genuine high-priority issue, but the supporting signals are mixed in quality. The CVSS 3.1 base score is 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low attack complexity, only low-level privileges needed, no user interaction, a changed scope, and high impact to confidentiality, integrity and availability - the near-maximum score is driven by the scope change combined with a low privilege requirement. The vendor-independent priority label is 'act_now', and a patch is already available, which together argue for prompt remediation. However, several exploitation signals are simply absent: no EPSS probability is supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present - so exploitation status is 'no public exploit identified at time of analysis'. The absence of EPSS/KEV/PoC is not evidence of safety, but it does mean the 9.9 reflects potential severity rather than demonstrated in-the-wild activity. A notable caveat: the description is generic Cisco/Splunk 'security hardening' boilerplate (CWE-707, improper neutralization) and does not describe the trigger, so the mechanism behind the scope change and the impact claims cannot be independently verified from the supplied text - the metrics describe severity, not how the flaw is reached. Net: treat as act_now because of the score, authenticated-but-low bar, and available fix, while recognizing the real-world exploitation likelihood is currently unquantified.

An attacker holding a low-privilege authenticated account on a Splunk Enterprise instance sends crafted input over the network that is improperly neutralized by the application, crossing a security boundary (CVSS scope change) to affect resources beyond the attacker's authorized context. Because PR:L and no user interaction are required, any valid low-tier Splunk user - or an attacker who has obtained such credentials - could attempt it; the precise trigger is not described in the available sources. No public exploit code or PoC reference is present in the supplied data.