Vulnerability CVE-2026-76299 describes an improper access control flaw in Splunk Enterprise that permits unauthorized users to perform privileged actions or access restricted data. This type of weakness can compromise the confidentiality and integrity of the platform and potentially allow an attacker to execute commands that should be protected by the system’s authentication and authorization mechanisms.

Splunk Enterprise, all released versions prior to the patched versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16, are affected. Upgrading to any of these or newer releases resolves the issue.

The overall risk can be more precisely quantified now that the CVSS score of 9.9 is available, indicating a critical severity. The vulnerability is a classic improper access control weakness, which typically gives significant leverage to an attacker that can reach the target system. The attack vector is not explicitly detailed in the advisory, but the flaw likely requires a legitimate or compromised user identity or exploitation of a permission handling bug. Because the vulnerability is not listed in the CISA KEV catalog and the EPSS score is < 1%, the probability of active exploitation may be low, but the impact of exploitation is high enough to warrant immediate remediation.