# CVE-2026-76299: Splunk Enterprise improper access control

Source: https://junglewise.ai/threats/cve-2026-76299-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76299 · Severity: info · Published 2026-10-21

Splunk Enterprise, a platform used for data indexing and analysis across organizations, contains an improper access control vulnerability that could allow unauthorized users to gain access to sensitive data or functionality. Cisco conducted an internal security review and identified this flaw as part of a software hardening release. The vulnerability requires upgrading to patched versions to mitigate the risk.

Technologies: [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76299 being exploited in the wild.

**How severe is CVE-2026-76299?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Splunk Enterprise 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3.

**Is there a fix for CVE-2026-76299?** Yes: fixed in Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76299 attacked?** It is in a hosted service.

**Am I affected by CVE-2026-76299?** Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4

## Technical details

CVE-2026-76299 is grouped under CWE-284 (Improper Access Control) and represents one of multiple vulnerabilities discovered during Splunk's internal security review. The highest CVSS score for this vulnerability group is 9.9, indicating critical severity. Affected versions span Splunk Enterprise 9.4 through 10.4, with fixes available in versions 9.4.16, 10.0.11, 10.2.8, and 10.4.4.

## Affected products

- Splunk Enterprise 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3

## Timeline

- 2026-10-21: disclosed

## References

- [https://advisory.splunk.com/advisories/SVD-2026-1008](https://advisory.splunk.com/advisories/SVD-2026-1008)

## Related threats

- [Splunk Enterprise improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76302-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise protection mechanism failure](https://junglewise.ai/threats/cve-2026-76301-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper resource control](https://junglewise.ai/threats/cve-2026-76300-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecar](https://junglewise.ai/threats/cve-2026-76298-in-splunk-enterprise-versions-below-10-4-4-and-10-2-8-a-user-who)
- [Splunk Enterprise federated search provider CSRF state change](https://junglewise.ai/threats/cve-2026-76297-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4)