CVE-2026-76355

The CVSS 7.5 on CVE-2026-76355 masks a more nuanced reality. The EPSS of 0.00354 tells you something the severity score doesn't: this unauthenticated REST endpoint in Splunk's Edge Processor isn't being widely exploited in practice, and the gap between those two numbers is where your analysis should start. Edge Processor, introduced in Splunk 10.4, explicitly operates at the network perimeter — closer to untrusted data sources than core Splunk infrastructure. The vulnerability exposes pipeline configuration data without credentials, but the question isn't whether the endpoint exists; it's whether Splunk designed this exposure into the architecture. If network isolation is the intended security boundary rather than authentication, this becomes a deployment-hardening issue, not a code defect. Check Splunk's Edge Processor deployment documentation: does it specify mandatory network isolation, or is it merely recommended? If it's the latter, organizations following Splunk's guidance literally are still exposed. The deeper concern is what pipeline configurations actually expose. These aren't just readable data — they're operational blueprints showing ingestion sources, transformation logic, and downstream data flows. A 7.5-rated CVE that yields your entire Splunk topology becomes far more dangerous when chained with any follow-on vulnerability that requires knowing where to target. EPSS measures standalone exploitability, not cascade potential. Your priority: verify whether Edge Processor endpoints are reachable from untrusted networks, regardless of what the CVSS suggests about urgency. If Splunk's documentation treats network isolation as optional, treat it as mandatory in your deployment. The real security boundary here lives in your network architecture, not in Splunk's code.

Reviewed through automated stages and approved by a human before publication.