Is CVE-2026-76299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76299 being exploited in the wild.

How severe is CVE-2026-76299?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Splunk Enterprise 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3.

Is there a fix for CVE-2026-76299?

Yes: fixed in Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-76299?

Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76299: Splunk Enterprise improper access control

CVE-2026-76299 · Severity: info · Published 2026-10-21

Splunk Enterprise, a platform used for data indexing and analysis across organizations, contains an improper access control vulnerability that could allow unauthorized users to gain access to sensitive data or functionality. Cisco conducted an internal security review and identified this flaw as part of a software hardening release. The vulnerability requires upgrading to patched versions to mitigate the risk.

Technologies: Splunk Enterprise. Vendors: Splunk.

Quick answers

Is CVE-2026-76299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76299 being exploited in the wild.
How severe is CVE-2026-76299?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Splunk Enterprise 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3.
Is there a fix for CVE-2026-76299?: Yes: fixed in Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76299 attacked?: It is in a hosted service.
Am I affected by CVE-2026-76299?: Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4

Technical details

CVE-2026-76299 is grouped under CWE-284 (Improper Access Control) and represents one of multiple vulnerabilities discovered during Splunk's internal security review. The highest CVSS score for this vulnerability group is 9.9, indicating critical severity. Affected versions span Splunk Enterprise 9.4 through 10.4, with fixes available in versions 9.4.16, 10.0.11, 10.2.8, and 10.4.4.

Affected products

Splunk Enterprise 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3

Timeline

2026-10-21: disclosed

References

https://advisory.splunk.com/advisories/SVD-2026-1008

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.