CVE-2026-76268Splunk Missing Authentication
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
Published Oct 7, 2026 · Updated Oct 14, 2026 · Also known as EUVD-2026-94620, GHSA-rxjh-rj2v-47gx
Key Facts
Patch in the next maintenance window- CVE-2026-76268 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Splunk, Splunk Enterprise.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including Splunk Enterprise 10.2.7, Splunk Enterprise 10.4.3, Splunk 10.2.7.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
1.6%
Higher than 75.2% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
40/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://advisory.splunk.com/advisories
- advisoryUSOM advisory
Description
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations.
For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.
Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SplunkSplunk | See advisory | 10.2.7 |
| Splunk Enterprise | >= 10.4 | 10.4.3 |
Patched Releases
Splunk Enterprise
10.2.7, 10.4.3
Splunk
10.2.7, 10.4.3
Timeline
Publicly disclosed
Oct 7, 2026
Last updated
Oct 14, 2026
Weakness Type
- CWE-306 Missing Authentication for Critical Function
References
- advisoryadvisory.splunk.com · advisories
- advisoryUSOM advisory
- otheradvisory.splunk.com · SVD-2026-1001
FAQ
Common Questions.
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands.
Affected: Splunk; Splunk Enterprise versions >= 10.4. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Splunk Enterprise 10.2.7, Splunk Enterprise 10.4.3, Splunk 10.2.7.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-76268 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo