Splunk fixes CVE-2026-76267 in REST API across three branches

Splunk issued SVD-2026-1001 fixing CVE-2026-76267 (CVSS 4.3, CWE-117) in the REST API. A user with the read_o11y_content capability could inject forged entries into the app log via the Splunk App for Splunk O11y Cloud. Fixes land in 10.4.3, 10.2.7 and 10.0.10; the 9.4.x branch is unaffected.

• CVE-2026-76267: CVSS 4.3, CWE-117, affects the REST API
• Fixed in 10.4.3, 10.2.7 and 10.0.10
• Splunk Enterprise 9.4.x is not affected
• ZoomEye found 114,223 exposed Splunk Enterprise instances