CVE-2026-76288 Splunk CVE debrief

Who should care

Splunk Enterprise administrators, security teams, and IT personnel responsible for patching and securing Splunk instances should be aware of this vulnerability and take immediate action to patch vulnerable systems.

Why it matters

Defenders should prioritize patching vulnerable Splunk Enterprise instances to prevent potential Denial of Service (DoS) conditions. This vulnerability allows an unauthenticated user to cause Splunk Web to stop responding to requests, requiring a restart of Splunk Enterprise. Administrators and security teams should verify the version of Splunk Enterprise and take immediate action to patch vulnerable systems, especially those exposed to the internet or used by unauthenticated users.

• Potential Denial of Service (DoS) condition
• Unauthenticated access to Splunk Web JavaScript logger endpoint
• Required patching to prevent exploitation
• Verification of Splunk Enterprise version and exposure

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16. An unauthenticated user can send a crafted request to the Splunk Web JavaScript logger endpoint, causing a Denial of Service (DoS) condition. Splunk Web remains unavailable until Splunk Enterprise is restarted. This issue allows an attacker to cause Splunk Web to stop responding to requests, requiring a restart of Splunk Enterprise. Defenders should prioritize patching vulnerable Splunk Enterprise instances, especially those exposed to the internet or used by unauthenticated users.

Defensive priority

Defenders should prioritize patching vulnerable Splunk Enterprise instances, especially those exposed to the internet or used by unauthenticated users.

Recommended defensive actions

• Patch Splunk Enterprise instances to versions 10.4.4, 10.2.8, 10.0.11, or 9.4.16, or later
• Restrict access to the Splunk Web JavaScript logger endpoint
• Monitor Splunk Enterprise logs for suspicious activity
• Verify that Splunk Web is not exposed to the internet or untrusted networks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Splunk has also published an advisory (SVD-2026-1007) detailing the issue and recommended patches. This vulnerability affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Defenders should verify the version of Splunk Enterprise and take immediate action to patch vulnerable systems, especially those exposed to the internet or used by unauthenticated users. Evidence is limited to public CVE details and vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.