Resource Exhaustion in Splunk Enterprise by Unauthorized User Access
CVE-2026-76289

6.5MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
21 October 2026

What is CVE-2026-76289?

In Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthorized user can exploit a flaw in the REST API endpoint for lookup table files, resulting in service disruption. The vulnerability arises from inadequate resource utilization limits, enabling such users to overwhelm the system and necessitating a restart for restoration of service. This exploitation poses significant risks to data availability and user access.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.4

Splunk Enterprise 10.2 < 10.2.8

Splunk Enterprise 10.0 < 10.0.11

References

https://advisory.splunk.com/advisories/SVD-2026-1007

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Cardoso (tvmpt)
.