DEV Community

jeffrey
jeffrey

Posted on

Reading the CVE-2026-76267 advisory as a version matrix

#splunk #cve202676267 #loginjection #cwe117

Reading the CVE-2026-76267 advisory as a version matrix

Vendor advisories in a batch are easiest to act on when they are read as a version matrix rather than as prose. CVE-2026-76267 is a clear case.

Vulnerability overview

Splunk issued SVD-2026-1001 on 7 October 2026. Within it, CVE-2026-76267 carries a Medium rating, a CVSSv3.1 base score of 4.3 and CWE-117. The CVE.org record, assigned by Cisco PSIRT on behalf of Splunk, lists the affected module as the REST API and published the entry on 7 October 2026.

The three-branch picture

The advisory organises Splunk Enterprise into four branches and names the fix for each. The affected ranges are 10.4.0 to 10.4.2, fixed in 10.4.3; 10.2.0 to 10.2.6, fixed in 10.2.7; 10.0.0 to 10.0.9, fixed in 10.0.10; and 9.4.0 to 9.4.14, fixed in 9.4.15.
For this CVE the fourth row is a non-event. The vendor states that Splunk Enterprise 9.4.x is not affected, so the 9.4 fix line belongs to the batch, not to this defect. A matrix read prevents an administrator from treating every row as equally urgent.

Turning the matrix into a patch order

Start by recording the branch and exact version of every Splunk Enterprise instance, including search head cluster members and any app-hosted deployments. Read the version from the running product rather than from a deployment manifest, since upgrades do not always update every artifact.
Then place each instance in one of four cells: branch 10.4 below 10.4.3, branch 10.2 below 10.2.7, branch 10.0 below 10.0.10, or unaffected 9.4.x. Anything in the first three cells is in scope for CVE-2026-76267 once the Splunk App for Splunk O11y Cloud is confirmed present.
The remaining work is ordinary. Sequence the upgrades so that cluster members are handled with the usual rolling discipline, and keep a written record of which instance moved from which version to which, because the same matrix is reused by the other 21 CVEs in the batch.

The mechanism, briefly

Splunk states that on affected branches a user holding a role with the read_o11y_content capability could inject forged entries into the app log through the REST API. The app writes user-supplied SignalFlow content without neutralizing it first. Nothing in the description requires more than a valid account and a reachable REST API.

Impact and scope

The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Confidentiality and availability are unaffected; integrity of the log is low-impact. The CVE record names the REST API as the module, and the advisory names the Splunk App for Splunk O11y Cloud as the vulnerable component, so the app must be installed.

Exposure context

A ZoomEye search for app="Splunk Enterprise" returned 114,223 matching assets on 10 October 2026, which indicates how large the exposed population is. It does not tell you which branch any asset runs. A vul.cve="CVE-2026-76267" query returned 0 for the same reason: the CVE is not yet indexed against specific assets. Version data has to come from your own inventory.

Remediation and mitigations

Upgrade to 10.4.3, 10.2.7, or 10.0.10 as the branch requires, or to a later release. No additional remediation step is recorded for this CVE. Verify the fix by confirming the running version on each host after the upgrade, not only the package version on disk.

References

Top comments (0)