Improper Neutralization in Splunk Enterprise - CVE-2026-76284
Published: October 15, 2026
Vulnerability identifier: #VU155951
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76284
CWE-ID: CWE-707
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially alter how supplied data is interpreted and interfere with intended software behavior.
The vulnerability exists due to improper neutralization in Splunk Enterprise when processing data containing elements with special meaning. A remote attacker can potentially supply data containing insufficiently neutralized elements to alter its interpretation in a downstream processing context.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76284
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3