Splunk Enterprise improper adherence to coding standards flaw is remotely exploitable without credentials (CVE-2026-76285)

What happened

Splunk's advisory describes a set of internally identified vulnerabilities in Splunk Enterprise, grouped under CWE-710 and assigned CVE-2026-76285. The CVE record rates the group critical with a CVSS 3.1 score of 9.8. The vector shows the flaw is reachable over the network, has low attack complexity, and requires no privileges or user interaction. An attacker who can reach an affected instance may cause high impact to confidentiality, integrity and availability on the vulnerable component.

Splunk has not described a specific exploit technique in the advisory, and the CVE record does not report exploitation in the wild or public disclosure of technical details. CISA's KEV catalogue does not list the flaw. Treat this as a patch-priority issue rather than a confirmed active threat.

Who is affected

Affected versions are Splunk Enterprise 10.4 to before 10.4.3, 10.2 to before 10.2.7, 10.0 to before 10.0.10, and 9.4 to before 9.4.15. Organisations running any of these branches should identify their deployments and plan the upgrade, regardless of whether the instance is internet-facing, because the flaw is reachable over the network without credentials or user interaction.

What to do now

1. Upgrade affected Splunk Enterprise instances to the fixed builds: Splunk Enterprise 10.4.3, 10.2.7, 10.0.10, or 9.4.15, depending on your branch.
2. Prioritise hosts that are reachable from untrusted networks, since the flaw requires no authentication or user interaction.
3. If you cannot patch immediately, restrict network access to affected Splunk Enterprise systems and monitor them closely; Splunk's advisory does not describe a workaround.

Beyond the patch

A critical, network-reachable flaw with no user interaction makes exposure the first question: is any affected Splunk Enterprise instance reachable from a network you do not control? Our Virtual CISO Services (vCISO) help you maintain exposure management so open ports and exposed services are identified before an advisory forces the issue. Because this is also a vendor patch-cycle problem, our Supply Chain Defense & Third-Party Risk work tracks which Splunk releases you run and how quickly fixes arrive, so the gap between disclosure and remediation is measured and closed.