CVE-2026-76297 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with the edit_federated_providers capability should assess exposure and prioritize verification of federated search configurations to prevent potential temporary prevention of federated searches from retrieving data from remote datasets.

Why it matters

CVE-2026-76297 is a medium-severity vulnerability in Splunk Enterprise that could allow an unauthenticated user to trick a user into turning off federated search providers, potentially impacting data retrieval from remote datasets. Splunk Enterprise administrators and users with the edit_federated_providers capability should assess exposure and prioritize verification of federated search configurations.

• Potential temporary prevention of federated searches from retrieving data from remote datasets
• Requires verification of user roles with edit_federated_providers capability
• Necessitates assessment of Splunk Enterprise deployments for vulnerability

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16. An unauthenticated user could trick a user with the edit_federated_providers capability into turning off all federated search providers. This could temporarily prevent federated searches from retrieving data from remote datasets. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser.

Defensive priority

Assess exposure of Splunk Enterprise deployments, prioritize verification of federated search configurations

Recommended defensive actions

• Assess exposure of Splunk Enterprise deployments
• Verify federated search configurations
• Prioritize verification of user roles with edit_federated_providers capability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16. An unauthenticated user could trick a user with the edit_federated_providers capability into turning off all federated search providers, potentially preventing federated searches from retrieving data from remote datasets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.