CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-76268 — In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w...

·Source: NIST NVD

Updated:

Executive Summary

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration op

Analysis

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected. CVSS Score: 9.8. Published: 2026-10-07T21:17:17.607.

Indicators of Compromise (3)

CVE (1)
CVE-2026-76268
NVDMITRE CVE
URL (1)
https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings)
VirusTotalURLhaus
Domain (1)
help.splunk.com
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]

BleepingComputer
MEDIUMVulnerability

Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme

Chukwuemeka Victor Amachukwu hacked tax preparation businesses, filed false tax returns and enticed victims to send him money for investment schemes. The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop .

CyberScoop
MEDIUMVulnerability

Zeabur shutting down after second security breach in two months

Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]

BleepingComputer