CVE-2026-76269: Improper Access Control in Splunk Enterprise REST Search Job Retrieval

CVE-2026-76269 is a security flaw affecting Splunk Enterprise that allows unauthorized access to search job results through the REST API. This vulnerability, classified under CWE-639, stems from an improper authorization check, enabling users to access job artefacts belonging to others when the key or identifier in a retrieval request falls under their control.

Splunk addressed the issue in October 2026's security patch, which encompassed 22 vulnerabilities across Splunk Enterprise 10.4, 10.2, and 10.0 branches, with fixes released as advisories SVD-2026-1001 and SVD-2026-1002. No known public exploits exist for this batch. The impact of this flaw is significant, as search jobs typically contain raw event data from various indexes, which, when accessed by unauthorized users, can expose sensitive information such as security telemetry, application records, and personal data subject to regulatory regulations.

Unlike memory corruption issues, this flaw is more stealthy, with no crash or noticeable operational trace upon successful exploitation. Affected versions span from 9.4.0 to 10.4.2, with patches available in subsequent releases. While ZoomEye reports 114,213 and 47,630 instances for Splunk Enterprise and Splunk respectively, these counts represent internet-reachable deployments.

Remediating this vulnerability involves installing the latest branch release and reviewing role assignments, as even patched servers may still grant access based on the current permission model. Administrators should also audit REST access tokens, retire unused service accounts, and monitor search job retrieval patterns for anomalies.