CVE-2026-76288: Splunk Enterprise denial of service via Content-Type header parsing

CVE-2026-76288 · Severity: high · CVSS 7.5 · Published 2026-10-21

Splunk Enterprise is a data analytics platform used to search and monitor operational data. An unauthenticated attacker can send a single crafted request to the Splunk Web interface that crashes the web component, making it unavailable until the system is restarted. This creates a denial of service that blocks legitimate users from accessing their data.

Technologies: Splunk Enterprise. Vendors: Splunk.

Quick answers

Is CVE-2026-76288 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76288 being exploited in the wild.
How severe is CVE-2026-76288?
High severity, with a CVSS score of 7.5, published 21 October 2026.
Which products and versions are affected?
Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
Is there a fix for CVE-2026-76288?
Yes: fixed in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16. Until then: Disable Splunk Web by setting the appropriate configuration in web.conf and restarting Splunk Enterprise if the web interface is not required. See the Splunk documentation on disabling unnecessary components for configuration details. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76288 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-76288?
Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16

Disable Splunk Web by setting the appropriate configuration in web.conf and restarting Splunk Enterprise if the web interface is not required. See the Splunk documentation on disabling unnecessary components for configuration details.

Technical details

The Splunk Web JavaScript logger endpoint fails to limit request-header parsing before processing requests, allowing an unauthenticated remote attacker to send a specially crafted request with malicious Content-Type headers that triggers a denial of service. The vulnerability crashes Splunk Web without requiring authentication, user interaction, or network adjacency. A full restart of Splunk Enterprise is required to restore service.

Affected products

  • Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.