What is CVE-2026-76267?

CVE-2026-76267 is a medium-severity vulnerability in Splunk Enterprise, classified under Improper Output Neutralization for Logs. CVSS score: 4.3/10. Published 2026-10-07.

How severe is CVE-2026-76267?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Splunk Enterprise

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterprise versions 9.4.x are not affected.

Published 2026-10-07 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Splunk Enterprise

Weakness classification (CWE)

CWE-117 — Improper Output Neutralization for Logs

References

advisory.splunk.com/advisories/SVD-2026-1001

Frequently asked questions

What is CVE-2026-76267?: CVE-2026-76267 is a medium-severity vulnerability in Splunk Enterprise, classified under Improper Output Neutralization for Logs. CVSS score: 4.3/10. Published 2026-10-07.
How severe is CVE-2026-76267?: Medium severity. CVSS v3 base score is 4.3 out of 10.