In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the ap…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 7, 2026 · NIST NVD

   Detected

   In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterp

2. Oct 14, 2026 · NIST NVD

   Updated

   In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterp

Affected

• cpe splunk/splunkversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-76267

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-76267

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-76267

  In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App fo

  nvd.nist.gov

References

• Vendor Advisory · advisory.splunk.com