CVE-2026-76299: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

CVE-2026-76299 involves improper or insufficient access control in Splunk Enterprise, categorized under CWE-284. This vulnerability was discovered internally by Cisco during a comprehensive security review and led to a hardening release that fixes multiple related issues. Affected versions include Splunk Enterprise versions from 9.4 up to but not including 9.4.16, 10.0 up to but not including 10.0.11, 10.2 up to but not including 10.2.8, and 10.4 up to but not including 10.4.4. No CVSS score or detailed exploit information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized actors to access resources that should be restricted, potentially leading to unauthorized data exposure or actions within Splunk Enterprise environments running affected versions. The exact impact depends on the resource accessed and the deployment context but generally represents a significant security risk due to broken access controls.

A software hardening release addressing this vulnerability has been made available by Cisco. Users should upgrade to versions 9.4.16 or later, 10.0.11 or later, 10.2.8 or later, and 10.4.4 or later to remediate this issue. Patch status is confirmed by the provided affected version ranges indicating fixed versions. No additional mitigation steps are indicated by the vendor advisory.