Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76312 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-20 |
| Vendor | Splunk |
| Product | Splunk Enterprise |
| CVSS Score | 9.4 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. For m…
Required Actions
- Update Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9 or 9.4.14 depending on your branch. Note: CVE-2026-76312 requires at least 10.4.1, the others in this group require 10.4.2 — pick the higher one.
- Separately update the Splunk MCP Server app to 1.2.1 or later (CVE-2026-76404). That is a different advisory and a different update path — updating the platform alone does not cover it.
- Review where embedded reports are used in your organization. They are the vector: an embed token in a page’s HTML source is enough to recover session material. If reports are embedded on publicly reachable or broadly internal pages, prioritize accordingly.
- After updating, consider invalidating existing embed tokens — the patch closes the vector but does not invalidate tokens that may already have been captured.
- Consider the nature of the system: Splunk aggregates logs from the entire infrastructure. Access to it means access to the organization’s whole security picture, including evidence that would reveal a breach elsewhere.
Who Is Affected?
Organizations using Splunk Enterprise as a SIEM or log analytics platform, particularly those embedding Splunk reports on internal pages or portals. Affects all branches below 10.4.2 / 10.2.6 / 10.0.9 / 9.4.14.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
