Splunk Enterprise Security Hardening Release SVD-2026-1008: CVE-2026-76299 and CVE-2026-76302 Rated 9.9, Upgrade Now

Splunk published a security hardening release for Splunk Enterprise on 21 October 2026. Advisory SVD-2026-1008 covers "multiple internally identified vulnerabilities", grouped into four CVEs. Two of them, CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization), carry Splunk's highest score in the advisory: CVSS 3.1 9.9, Critical. The fixed versions are Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 and 10.4.4.

Splunk Enterprise is where many organisations, and many of their suppliers, keep security logs, so a flaw in it matters beyond the platform itself. The facts so far are less alarming than the score alone. Splunk found these issues itself. The CVSS vector that CISA added to the two 9.9 CVEs says an attacker would need a low-privileged account, not just network access. Splunk's advisory does not mention exploitation. As of 23 October 2026, 08:33 Cyprus time (UTC+3), we found no report of exploitation, CISA's assessment of the two 9.9 CVEs records exploitation as "none", and none of the four CVEs is in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Information

What Splunk has said (SVD-2026-1008, published 21 October 2026):

• "Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16."
• "The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group."
• "Each CVE groups findings in one CWE category. Its score is the highest CVSS score among those findings." A CVE here stands for several flaws, and its score describes the worst one.
• Splunk lists no workaround or mitigation. Its only remedy is to upgrade.

Splunk rates the advisory as a whole "9.9, Critical".

What the CVE records add. Cisco is the CNA that published the four CVE records, and their text describes the work as Cisco's internal security review. The records mark the discovery as "INTERNAL" and carry no CVSS score or vector. Splunk's advisory gives scores but no vector either. CISA's vulnerability enrichment (CISA-ADP), shown on NVD, adds a 9.9 vector for CVE-2026-76299 and CVE-2026-76302: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. "PR:L" means an attacker needs low privileges, that is, a valid low-privileged account. CISA's SSVC assessment for those two CVEs, dated 22 October, records exploitation as "none", automatable as "no" and technical impact as "total". CISA has added nothing to the records for CVE-2026-76300 and CVE-2026-76301. NVD lists all four CVEs as "Awaiting Analysis" and has not published its own score.

What is not known. Splunk has not described the individual flaws behind each CVE, which components they affect, or what an attacker could do with them. Splunk's advisory does not mention exploitation either way.

Splunk Cloud Platform. SVD-2026-1008 lists only Splunk Enterprise. It does not mention Splunk Cloud Platform, either as affected or as already fixed. We have not found a Splunk statement on Splunk Cloud for this advisory. If you or your suppliers use Splunk Cloud, ask Splunk support (Rescana guidance).

Related Splunk advisories the same day. The same Splunk Enterprise versions also fix a separate advisory, SVD-2026-1007 ("Security Vulnerabilities in Splunk Enterprise - October 2026", highest score 8.8), and third-party package updates in SVD-2026-1009. For Splunk SOAR, Splunk published separate advisories (SVD-2026-1010, SVD-2026-1011 and SVD-2026-1012), all fixed in SOAR 8.7.0. Those SOAR advisories have their own CVEs. They are not part of SVD-2026-1008.

Timeline (dates as published; Cyprus time, UTC+3, where a source gives a time):

• 14 October 2026: Splunk publishes an advance notice that it will publish advisories on 21 October.
• 21 October: Splunk publishes SVD-2026-1008, together with SVD-2026-1007, SVD-2026-1009 and the SOAR advisories.
• 22 October, 01:52: Cisco, as CNA, publishes the four CVE records (22:52 UTC on 21 October).
• 22 October, 02:17: The four CVEs appear in NVD (23:17 UTC on 21 October).
• 22 October: The Canadian Centre for Cyber Security issues AV26-1077. It lists Splunk Enterprise before 9.4.16, 10.0.11, 10.2.8 and 10.4.4, and Splunk SOAR before 8.7.0.
• 22 October, 16:11 to 16:12: CISA adds its CVSS vector and SSVC assessment to the CVE records for CVE-2026-76302 and CVE-2026-76299 (13:11 to 13:12 UTC).

Affected Product Versions

Per Splunk's SVD-2026-1008 (21 October 2026):

Splunk SOAR is not in SVD-2026-1008. SOAR 8.7.0 fixes the separate SOAR advisories listed above.

Workaround and Mitigation

1. Upgrade. Move Splunk Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4, or higher, on every instance, including search heads, indexers, deployment servers and heavy forwarders (Rescana guidance on scope; Splunk does not list components). Splunk lists no workaround.
2. Check the extra steps in SVD-2026-1007. That advisory, fixed by the same versions, says two of its CVEs need additional steps beyond upgrading. Read it while planning the upgrade.
3. Upgrade SOAR too, if you run it. Move Splunk SOAR to 8.7.0 for the separate SOAR advisories.
4. Until you upgrade, limit who can log in. Because the 9.9 CVEs need low privileges according to CISA's vector, review Splunk accounts, remove unused and shared ones, and keep Splunk Web and the management port off the internet (Rescana guidance).
5. Splunk Cloud. Confirm with Splunk whether your Splunk Cloud stack has these fixes (Rescana guidance).

Indicators of Compromise

Splunk has published no indicators of compromise for SVD-2026-1008, and none of the sources we checked report exploitation. The Canadian Centre for Cyber Security's AV26-1077 lists none either. Splunk does not map these vulnerabilities to MITRE ATT&CK, and we have not done so either. As general hygiene, review Splunk audit logs for unexpected logins, new accounts and role changes (Rescana guidance).

What we will update

We will update this post if Splunk revises SVD-2026-1008, publishes details of the individual flaws, or states the Splunk Cloud Platform status. We will also update it if exploitation is reported, if CISA adds either 9.9 CVE to the KEV catalog, or if NVD publishes its own scores.

Sources

Splunk

• Splunk, "Security Hardening in Splunk Enterprise - October 2026", SVD-2026-1008 (21 October 2026): https://advisory.splunk.com/advisories/SVD-2026-1008
• Splunk, "Security Vulnerabilities in Splunk Enterprise - October 2026", SVD-2026-1007 (21 October 2026): https://advisory.splunk.com/advisories/SVD-2026-1007
• Splunk Security Advisories index (SVD-2026-1006 advance notice; SVD-2026-1009 to SVD-2026-1012): https://advisory.splunk.com/

National CERTs, NVD and CVE

• Canadian Centre for Cyber Security, Splunk security advisory AV26-1077 (22 October 2026): https://www.cyber.gc.ca/en/alerts-advisories/splunk-security-advisory-av26-1077
• CVE Program and NVD: CVE-2026-76299 record (CNA: Cisco; CISA-ADP vector and SSVC): https://www.cve.org/CVERecord?id=CVE-2026-76299; NVD entries for CVE-2026-76299 and CVE-2026-76302 (Awaiting Analysis, checked 23 October 2026, 08:33 Cyprus time): https://nvd.nist.gov/vuln/detail/CVE-2026-76299 and https://nvd.nist.gov/vuln/detail/CVE-2026-76302
• CISA, Known Exploited Vulnerabilities catalog (checked 23 October 2026, 08:33 Cyprus time; catalog version 2026.10.21; none of the four CVEs listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Why this matters for your vendors

Many suppliers rely on Splunk to detect, and tell you about, incidents that could affect your data. A quick check on which suppliers run self-managed Splunk Enterprise, and whether they have moved to the fixed versions, keeps the conversation short and focused.

Forward this to your TPRM owner (Rescana guidance). A short, friendly check with suppliers whose security monitoring runs on Splunk:

• Do you run Splunk Enterprise yourselves, use Splunk Cloud Platform, or have Splunk run for you by an MSSP?
• If you run Splunk Enterprise, are all instances on 9.4.16, 10.0.11, 10.2.8 or 10.4.4 or later? If not, when will they be?
• If you use Splunk Cloud, has Splunk confirmed that your stack has these fixes?
• Who can log in to your Splunk platform, and is Splunk Web or the management port reachable from the internet?
• If you run Splunk SOAR, is it on 8.7.0?

Want a fast, evidence-based view of which suppliers run security platforms like these, and how quickly they patch? Book a demo.