CVE-2026-76301
Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Critical
- CVSS 9.8
- EPSS 0.17%
- Fixed version listed
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
From the CVE record.
Read the original description
CVE record
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76301 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise | from 10.4, before 10.4.4; from 10.2, before 10.2.8; from 10.0, before 10.0.11; from 9.4, before 9.4.16 | 10.4.4, 10.2.8, 10.0.11, 9.4.16 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by CISA-ADP)
- EPSS
- 0.17% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 27, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 28, 2026.
- Weakness
- CWE-693: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- Vendor
- Splunk, Splunk Enterprise
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.