CVE-2026-76279

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works) in the Splunk documentation.

• CWE-20

• https://advisory.splunk.com/advisories/SVD-2026-1001

Published

Oct 7, 2026

Last Modified

Oct 10, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76273In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,…4.3
• CVE-2026-76274In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0…6.5
• CVE-2026-76275In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,…4.3
• CVE-2026-76276In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0…4.3
• CVE-2026-76277In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,…4.1
• CVE-2026-76278In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0…4.3
• CVE-2026-7628A vulnerability was detected in crazyrabbitLTC mcp-code-revi…6.3
• CVE-2026-76280In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,…6.3
• CVE-2026-76281Improper Access Control. Splunk addressed multiple internall…5.3
• CVE-2026-76282Improper Control of a Resource Through its Lifetime. Splunk …8.8
• CVE-2026-76283Protection Mechanism Failure. Splunk addressed multiple inte…7.6
• CVE-2026-76284Improper Neutralization. Splunk addressed multiple internall…9.8