EUVD-2026-94585
GHSA-787c-75gx-5xvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Splunk Enterprise endpoint
-
ExploitSend crafted injection payload
-
ExecutionTrigger improper neutralization flaw
-
ImpactDisclose data or compromise system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Improper neutralization
|
| Exploitation Conditions | The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote unauthenticated exploitation of Splunk Enterprise with no user interaction, which would mean no special conditions are required. However, this CANNOT be confirmed from the description, which only states 'Improper Neutralization' (CWE-707) grouped across multiple internally-identified issues and names no specific feature, endpoint, protocol, or configuration mode. Limiting factors: exploitation requires network reachability to the Splunk Enterprise management/data interface (often restricted to internal networks or behind authentication in hardened deployments); the 'Information Disclosure' tag and injection CWE suggest the real-world trigger may require a reachable input-handling feature that the sparse advisory does not enumerate. Defenders should consult Splunk advisory SVD-2026-1002 for the concrete affected component before assuming default-config unauthenticated exposure. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8 Critical) describes a network-reachable, unauthenticated, low-complexity flaw with full compromise of confidentiality, integrity, and availability - on paper a maximum-urgency issue. However, the corroborating exploitation signals do not support treating this as an imminent mass-exploitation threat: EPSS is only 0.15% (4th percentile), it is NOT listed in CISA KEV, and no public proof-of-concept or exploit code is referenced. Exploitation status: no public exploit identified at time of analysis. A significant data-quality tension exists: the vulnerability was internally discovered and reported by Splunk/Cisco (not found in the wild), the CWE is CWE-707 (Improper Neutralization, an injection-class weakness) and the tag is 'Information Disclosure', yet the CVSS asserts full C:H/I:H/A:H impact and PR:N - these are hard to reconcile and the public description is deliberately generic (Splunk groups multiple distinct issues under one CVE), so the exact attack surface and whether authentication is truly required cannot be independently verified from the provided data. Net assessment: patch on the normal-to-expedited enterprise cadence because the CVSS is critical and a fix is already available, but the absence of KEV/POC and the very low EPSS indicate no evidence of active or imminent exploitation; the headline 9.8 likely reflects a worst-case grouping rather than a confirmed trivially-exploitable unauthenticated RCE. |
| Exploit ScenarioDerived | A remote attacker sends specially crafted input to an exposed Splunk Enterprise instance, exploiting an improper-neutralization (injection-class) flaw to disclose sensitive data and/or compromise the system. Per the input CVSS the attack is network-based and low-complexity with no user interaction, but no public exploit code exists and the generic vendor description prevents confirming the exact trigger. No proof-of-concept is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Improper neutralization (injection-class weakness, CWE-707) in Splunk Enterprise lets an attacker submit crafted input through a network-reachable Splunk interface and achieve high impact across confidentiality, integrity, and availability - per our independent assessment, exploitation requires low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), even though the upstream NVD-style vector claims PR:N/unauthenticated. Affected are Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15; the vendor grouped multiple internally identified findings by CWE and assigned this CVE to the neutralization group, so the advisory names no single endpoint or feature. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (4th percentile), and the vulnerability is not listed as confirmed actively exploited (CISA KEV), so urgency should be driven by the critical severity and the accessibility of the affected interface rather than by observed exploitation.
RemediationAI
Vendor-released patches are available: upgrade Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10, or 9.4.15 as appropriate for the deployed branch, following the Splunk advisory SVD-2026-1002 (https://advisory.splunk.com/advisories/SVD-2026-1002) for the specific component and any restart requirements; there is no workaround published in the available data, so patching is the primary remedy. Where immediate upgrade is not possible, compensating controls should target the network exposure and privilege surface: restrict reachability of Splunk management and REST endpoints (default 8089, plus 8000/8080 web ports) to trusted administrative networks or VPN only, accepting that this breaks distributed search peers, deployment servers, and external API integrations that rely on those ports; enforce least-privilege role assignment and disable or tightly scope unnecessary non-admin accounts and tokens, understanding this only mitigates the low-privilege vector in our assessment and does not address a truly unauthenticated path if one exists; and place a filtering reverse proxy or WAF in front of Splunk web endpoints, weighing the risk of false positives against legitimate search and ingest traffic. Because the advisory does not enumerate the injectable feature and no public exploit code has been identified at time of analysis, prioritize internet-exposed or broadly reachable Splunk instances first, and monitor the vendor advisory for updated component detail before assuming default-configuration exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-707 is "Improper Neutralization," the abstract parent class of injection families (e.g., CWE-74 improper neutralization of special elements in output used by a downstream component), meaning the root cause is that untrusted input is not correctly sanitized, quoted, escaped, or encoded before being interpreted by a downstream parser or command interpreter. In Splunk Enterprise, input sinks of this kind typically sit in search-processing, REST API, and other management/data-ingestion components, and because the vendor's SVD-2026-1002 advisory groups several internally identified issues by CWE with one CVE per group, the exact vulnerable component is not enumerated in the description. The CPE cpe:2.3:a:splunk:splunk_enterprise confirms the affected platform is the core Splunk Enterprise product rather than a cloud-only or add-on offering. Because the underlying weakness class permits manipulation of interpreted input, the realistic impact surface spans unauthorized data access, tampering with indexed or configuration data, and disruption of the Splunk service itself, which matches the assessed C:H/I:H/A:H. Defenders should treat the specific injectable surface as unresolved from public data and consult the vendor advisory for the authoritative component and any preconditions such as required role or token.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Injection-class flaw in an enterprise server implies network/low-complexity access, but Splunk interfaces typically require authentication, so PR:L is more defensible than the vendor's PR:N given the description provides no evidence of a pre-auth path.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
Executive ViewAI
A critical injection-class weakness in Splunk Enterprise (CVE-2026-76284) allows an attacker with low-privilege access to a network-reachable Splunk interface to compromise the confidentiality, integrity, and availability of the platform. Because Splunk is typically the central repository and correlation engine for security telemetry, a successful exploit could let an adversary read, tamper with, or disrupt the very logs and detections the organization relies on for incident response and compliance reporting. Leadership should treat this as a platform-integrity risk affecting security operations, audit evidence, and any business process that depends on Splunk data, and prioritize upgrading the affected branches (10.4, 10.2, 10.0, and 9.4) to their fixed releases.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB