Splunk Enterprise improper access control allows low-privilege network attackers to compromise systems (CVE-2026-76299)

What happened

Cisco states that an internal security review resulted in a software hardening release for Splunk Enterprise. CVE-2026-76299 groups multiple internally discovered vulnerabilities under improper access control (CWE-284). The CVE record describes the issue as reachable over the network, requiring only low privileges and no user interaction. A low-privileged account is enough; an attacker does not need to convince a user to click or open anything. In CVSS 3.1 terms, the flaw has a critical base score of 9.9, with high impact on confidentiality, integrity and availability, and scope changed, meaning compromise can extend beyond the vulnerable component. Cisco has not said whether these vulnerabilities have been exploited or publicly disclosed.

Who is affected

Splunk Enterprise is affected in these version ranges: 10.4 to before 10.4.4, 10.2 to before 10.2.8, 10.0 to before 10.0.11, and 9.4 to before 9.4.16. Any deployment on one of those releases should be treated as affected and prioritised for the upgrade. Administrators can compare installed versions directly with those ranges to confirm exposure. The CVE record does not list other affected products or versions.

What to do now

1. Identify every Splunk Enterprise deployment in your estate and confirm its version against the ranges above. 2. Schedule an upgrade to the fixed release for the installed version: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16. These are the only fixed versions listed. 3. The advisory does not list a workaround or other mitigation, so applying the upgrade should be the priority. 4. If you cannot patch immediately, restrict network access to affected Splunk Enterprise instances, monitor account activity, especially low-privilege accounts, and review logs for signs of misuse until the upgrade is complete.

Beyond the patch

Patch first. The broader point is supplier patch cadence: a critical access-control flaw in Splunk Enterprise leaves you exposed from the moment the fix is available until it is deployed across your estate. Tracking which vendors' software you run, and how quickly they fix serious issues, is supply-chain risk management. Our Supply Chain Defense & Third-Party Risk service does exactly that, so updates like CVE-2026-76299 are identified and scheduled before they become emergencies.