CVE-2026-76348

Received Received - Intake

Splunk Enterprise Search Head Cluster Denial of Service

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76348

EUVD

EUVD-2026-62913

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with a high-privilege role containing the list_search_head_clustering capability can send a read request to Search Head Cluster member control endpoints and change the cluster state, leading to a denial of service. The issue occurs because these endpoints do not require a state-changing HTTP request type before applying read-only authorization.

Impact Analysis

An attacker with the right privileges could disrupt Splunk Enterprise operations by causing a denial of service. This could lead to system unavailability, affecting data processing and search capabilities within the Splunk environment.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70