CVE-2026-76302

CriticalCVSS 9.9/10Last modified Oct 22, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-707

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 10.4, < 10.4.4; >= 10.2, < 10.2.8; >= 10.0, < 10.0.11; >= 9.4, < 9.4.16

References

https://advisory.splunk.com/advisories/SVD-2026-1008

Timeline

Published: Oct 21, 2026
Last modified: Oct 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-763034.8In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that CVE-2026-763044.3In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could downloa CVE-2026-763056.5In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive o CVE-2026-763067.5In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (RES CVE-2026-763077.2In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State CVE-2026-763086.5In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State T CVE-2026-763094.3In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splu CVE-2026-76315.4A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the compone CVE-2026-763109.4In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could downl CVE-2026-763119.4In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could downl CVE-2026-763129.4In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (CVE-2026-763138.8In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could p