# CVE-2026-76290: Splunk Enterprise denial of service through unauthenticated package downloads

Source: https://junglewise.ai/threats/cve-2026-76290-in-splunk-enterprise-versions-below-10-4-4-10-2-8-and-10-0-11-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76290 · Severity: high · CVSS 7.5 · Published 2026-10-21

Splunk Enterprise, a data analytics platform used by enterprises to index and search log data, contains a flaw in its Edge Processor feature that allows unauthenticated attackers to repeatedly request package downloads, causing the system to consume excessive resources and stop responding. An attacker can trigger a denial of service with minimal effort, disrupting analytics and log visibility across the organization.

Technologies: [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76290 being exploited in the wild.

**How severe is CVE-2026-76290?** High severity, with a CVSS score of 7.5, published 21 October 2026.

**Which products and versions are affected?** Splunk Enterprise 10.4.0–10.4.3, 10.2.0–10.2.7, 10.0.0–10.0.10.

**Is there a fix for CVE-2026-76290?** Yes: fixed in Enterprise 10.4.4, 10.2.8, 10.0.11. Until then: After upgrading, enable authentication for Edge Processor package downloads and restart Splunk Enterprise. See Splunk documentation on enabling authentication for Edge Processor package downloads. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76290 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76290?** Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Enterprise 10.4.4, 10.2.8, 10.0.11

After upgrading, enable authentication for Edge Processor package downloads and restart Splunk Enterprise. See Splunk documentation on enabling authentication for Edge Processor package downloads.

## Technical details

An unauthenticated endpoint in the Edge Processor package download functionality lacks both authentication checks and resource limits. Attackers can send repeated requests that cause the Splunk daemon to read and base64-encode complete packages in memory for each request, exhausting system resources. The affected versions are 10.4.0–10.4.3, 10.2.0–10.2.7, and 10.0.0–10.0.10; fixes are available in 10.4.4, 10.2.8, and 10.0.11.

## Affected products

- Splunk Enterprise 10.4.0–10.4.3, 10.2.0–10.2.7, 10.0.0–10.0.10

## Timeline

- 2026-10-21: disclosed

## References

- [https://advisory.splunk.com/advisories/SVD-2026-1007](https://advisory.splunk.com/advisories/SVD-2026-1007)

## Related threats

- [Splunk Enterprise improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76302-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise protection mechanism failure](https://junglewise.ai/threats/cve-2026-76301-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper resource control](https://junglewise.ai/threats/cve-2026-76300-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper access control](https://junglewise.ai/threats/cve-2026-76299-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecar](https://junglewise.ai/threats/cve-2026-76298-in-splunk-enterprise-versions-below-10-4-4-and-10-2-8-a-user-who)