{"id":"CVE-2026-76290","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-76290","generatedAt":"2026-10-27T23:57:32.771Z","title":"The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.\nThe vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.\nAfter upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).","published":"2026-10-21T23:17:27.000Z","lastModified":"2026-10-22T16:57:10.000Z","status":"Awaiting Analysis","sourceIdentifier":"psirt@cisco.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-400"],"affected":[],"epss":{"score":0.00497,"percentile":0.42372,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00406,"percentile":0.33758}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T23:17:27.000Z","detail":{"score":"7.5","severity":"HIGH","publishedAt":"2026-10-21T23:17:26.820Z"},"summary":"New CVE, high severity (CVSS 7.5)."}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-1007","source":"psirt@cisco.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76290","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}