CVE-2026-76353 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with access to knowledge bundle delta processing, as well as security teams monitoring for potential system integrity impacts and service disruptions. Affected operators should review official advisories, plan vendor-supported updates or mitigations, and restrict access to knowledge bundle delta processing.

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user without 'admin' or 'power' roles can submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This is possible because knowledge bundle delta processing does not restrict removal paths to the staging directory, and the endpoint does not enforce the expected authorization boundary. This could affect system integrity and disrupt service.

Defensive priority

Medium priority due to potential system integrity impact and service disruption.

Recommended defensive actions

• Inventory and verify Splunk Enterprise versions, checking for versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
• Apply vendor patches or updates to affected versions.
• Restrict access to knowledge bundle delta processing and enforce authorization boundaries.
• Monitor for suspicious activity related to knowledge bundle delta submissions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from NVD and Splunk advisory indicates vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Limited detail on affected scope and remediation steps. Further review of system integrity impacts and service disruptions is recommended. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.