CVE-2026-76271

Received Received - Intake

Denial of Service in Splunk Enterprise REST API

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is possible because the app uses an inefficient regular expression to validate input submitted through the endpoint. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and restmap.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/restmap.conf) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76271

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10. A low-privileged user without admin or power roles can cause a denial of service against a REST API endpoint in the Discover Splunk Observability Cloud app due to an inefficient regular expression used for input validation.

Detection Guidance

This vulnerability can be detected by checking the Splunk Enterprise version installed on your system. If the version is below 10.4.3, 10.2.7, or 10.0.10, it is vulnerable. Use the command 'splunk version' in the Splunk CLI to check the version. Additionally, monitor for unusual API endpoint activity or performance degradation in the Discover Splunk Observability Cloud app.

Impact Analysis

The vulnerability allows a low-privileged user to disrupt the availability of a REST API endpoint in the Discover Splunk Observability Cloud app, potentially causing service outages or degraded performance for users relying on this endpoint.

Compliance Impact

This vulnerability causes a denial of service against a REST API endpoint in the Discover Splunk Observability Cloud app. While it does not directly impact data confidentiality or integrity, a denial of service could disrupt access to critical monitoring and observability functions, potentially affecting compliance with standards like GDPR or HIPAA that require continuous availability of systems processing personal or health data.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, or 10.0.10 or later) to address the inefficient regular expression issue in the Discover Splunk Observability Cloud app.

Hi! I’m here to help you understand CVE-2026-76271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70