What’s Vulnerable › Vulnerabilities
CVE-2026-76289: Denial of Service (DoS) through the REST API in Splunk Enterprise
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-21 · updated 2026-10-30
- Weakness: CWE-770
Description
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service. The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections. For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Affected products
- Splunk Enterprise: from 9.4.0 before 9.4.16; from 10.0.0 before 10.0.11; from 10.2.0 before 10.2.8; from 10.4.0 before 10.4.4 — fixed in 9.4.16, 10.0.11, 10.2.8, 10.4.4
- Splunk Enterprise: from 10.4 before 10.4.4; from 10.2 before 10.2.8; from 10.0 before 10.0.11; from 9.4 before 9.4.16 — fixed in 10.0.11, 10.2.8, 10.4.4, 9.4.16
How to fix
Upgrade to a fixed version: Splunk Enterprise 9.4.16, 10.0.11, 10.2.8, 10.4.4; Splunk Enterprise 10.0.11, 10.2.8, 10.4.4, 9.4.16. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76289 or the next vulnerability affects your stack