CVE-2026-76268

Published Oct 7, 2026

Last updated 7 days ago

CVSS critical 9.8

Overview

Description
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Source
psirt@cisco.com
NVD status
Analyzed
Products
splunk

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

psirt@cisco.com
CWE-306

Social media

Hype score
Not currently trending

  1. Splunk Enterprise patches 46 vulnerabilities, including CVE-2026-76268 (CVSS 9.8) in the Patroni REST API of search head clusters. Unauthenticated remote code execution is possible when the API is reachable; a separate Linux privilege-escalation issue (CVE-2026-76266, CVSS 7.7)

    @WorldCyberNewsX

    9 Oct 2026

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Splunk Enterprise Patches 22 Flaws, Including Unauthenticated Patroni API Command Execution (CVE-2026-76268) Critical Vulnerability Alert! Splunk Enterprise is affected by CVE-2026-76268. 🔍 Identify Targets via ZoomEye: Filter: app="Splunk" Search Dork: app="Splunk

    @zoomeyebot

    9 Oct 2026

    40 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. ⚠️ Splunk fixes a critical Splunk Enterprise flaw that allows unauthenticated command execution CVE-2026-76268 Splunk has released advisory SVD-2026-1001, fixing 17 vulnerabilities in Splunk Enterprise. The most serious,… #CVE #Splunk #infosec https://t.co/QNldXQPr4e http

    @Orbitaley

    7 Oct 2026

    3 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76285 are related to improper adherence to coding standards and are grouped under the Common Weakness Enumeration (CWE) CWE-710.•CVE-2026-76285
  2. As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76284 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.•CVE-2026-76284
  3. In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view. The vulnerability is possible because Splunk Enterprise does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants. For more information see Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) and Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.•CVE-2026-76278
  4. In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works) in the Splunk documentation.•CVE-2026-76279
  5. As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76283 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.•CVE-2026-76283

References

Sources include official advisories and independent security research.