CVE-2026-76288
published 2026-10-21CVE-2026-76288: In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
29.9th percentile
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| splunk | splunk_enterprise | >= 10.0 < 10.0.11 | 10.0.11 |
| splunk | splunk_enterprise | >= 10.2 < 10.2.8 | 10.2.8 |
| splunk | splunk_enterprise | >= 10.4 < 10.4.4 | 10.4.4 |
| splunk | splunk_enterprise | >= 9.4 < 9.4.16 | 9.4.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web t
ghsa_unreviewed·2026-10-22
CVE-2026-76288 [HIGH] CWE-400 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web t
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
VulDB
Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 JavaScript Logger Endpoint input validation
vuldb·2026-10-22·CVSS 7.5
CVE-2026-76288 [HIGH] Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 JavaScript Logger Endpoint input validation
A vulnerability has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component JavaScript Logger Endpoint. This manipulation causes improper input validation.
The identification of this vulnerability is CVE-2026-76288. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published