Patch Forecast
Amber warning
Patch this week.

CVE-2026-76268

Splunk: missing authentication

Risk score
79/100
CVSS
9.8 v3.1
Exploit chance (30 days)
1.6%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible bec…
Affected
Splunk
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: SplunkTHE FLAWSTHE FIXCVE-2026-76268Missing authenticationCVSS 9.8 · EPSS 2%CVE-2026-76284As part of Cisco's ongoingcommitment to proactivesecurity and product quality…CVSS 9.8 · EPSS 0%CVE-2026-76285As part of Cisco's ongoingcommitment to proactivesecurity and product quality…CVSS 9.8 · EPSS 0%CVE-2026-76282As part of Cisco's ongoingcommitment to proactivesecurity and product quality…CVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedSplunkAMBER · PATCH THIS WEEKSplunkIn Splunk Enterprise versionsbelow 10.4.3 and 10.2.7, anunauthenticated user withnetwork access to the PatroniRepresentational StateTransfer (REST) ApplicationProgramming Interface (API)…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authentication (CWE-306)283 other warnings in 30 days →Same productEarlier Splunk warnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Splunk: Amber, patch this week. In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible bec…

The flaws

  • CVE-2026-76268: Missing authentication (CVSS 9.8 · EPSS 2%)
  • CVE-2026-76284: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-76285: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-76282: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Splunk

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

Last activity 7 Oct 2026. Patch Forecast updates every hour.