Vulnpedia
← Search CVEs

CVE-2026-76268

CRITICAL 9.8 DETECTION TEMPLATE

Published 2026-10-07 · Last modified 2026-10-21

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

4.8%chance of exploitation in 30 days · 92nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.8CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2026-76268 -u https://TARGETDetection template — review its checks and affected versions before use.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Splunk

Products Splunk Enterprise Splunk

Weakness (CWE)

  • CWE-306: The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate
  • https://github.com/murrez/CVE-2026-76268

    CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268

    PoC-in-GitHub · CVE-2026-76268
    PoC-in-GitHub · CVE-2026-76268 · Updated 2026-10-20T16:49:54Z

Known Affected Software Configurations

VendorProductVersion range
SplunkSplunk≥ 10.2.0 and < 10.2.7
SplunkSplunk≥ 10.4.0 and < 10.4.3

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Sources: NVD · CVE.org · EPSS