CVE-2026-76269: access control bypass in Splunk Enterprise

Splunk fixed CVE-2026-76269 (CVSS 6.5, CWE-639) in the Splunk Enterprise REST API for search job retrieval. Patches shipped in branches 10.4.3, 10.2.7, 10.0.10 and 9.4.15 as part of an October batch of 22 CVEs; no exploitation in the wild has been recorded.

• CVSS 6.5, CWE-639 authorization bypass via user-controlled key
• Affected: Splunk Enterprise 10.4.0–10.4.2, 10.2.0–10.2.6, 10.0.0–10.0.9, 9.4.0–9.4.14
• Fixes in 10.4.3, 10.2.7, 10.0.10 and 9.4.15
• ZoomEye: 114,213 internet-reachable Splunk Enterprise instances