Splunk patches 4 Critical flaws in Enterprise and SOAR

Key Takeaways

• Splunk has addressed 24 vulnerabilities across its Enterprise and SOAR platforms.
• Four critical flaws, with CVSS scores ranging from 9.3 to 9.9, are among the patched issues.
• Vulnerabilities span improper access control, remote code execution, denial of service, and exposed files.
• Affected products include Splunk Enterprise and Splunk SOAR, with specific versions requiring updates.
• Immediate patching is recommended, along with reviewing exposed interfaces and user roles.

Splunk has released a comprehensive set of security updates, patching 24 vulnerabilities across its flagship products, Splunk Enterprise and Splunk SOAR. The patches, issued on October 21, 2026, address four critical flaws with CVSS scores as high as 9.9, alongside numerous high and medium severity issues.

These vulnerabilities encompass a broad spectrum of weaknesses, including improper access control, critical input handling errors, exposed files, potential remote code execution, denial-of-service risks, and weak authorization checks. The fixes are detailed across three distinct advisories.

Splunk Enterprise Hardening and Critical Flaws

The Splunk Enterprise security hardening advisory highlights four internally discovered CVEs. Among these, CVE-2026-76299 and CVE-2026-76302 are particularly severe, both boasting a CVSS score of 9.9. These critical issues stem from improper access control and insufficient neutralization of specific inputs, respectively.

Additional vulnerabilities in this advisory include CVE-2026-76300, rated 8.8, which addresses inadequate resource lifecycle management, and CVE-2026-76301, with a score of 7.6, concerning a protection mechanism failure. Splunk’s methodology groups internal findings by weakness type, meaning each CVE may represent multiple related security concerns.

Splunk SOAR Vulnerabilities

Eight CVEs are addressed in the Splunk SOAR advisory, specifically for version 8.7.0. The most severe of these is CVE-2026-76531, another critical flaw rated 9.9, which could lead to sensitive files or directories being exposed to unauthorized external entities.

Another significant critical issue affecting Splunk SOAR is CVE-2026-76407, with a CVSS score of 9.3, related to improper access control. Other SOAR vulnerabilities include unsafe URL path validation, flawed input handling, weak resource management, and protection failures.

Critical Severity CVEs:

Additional Splunk Enterprise Flaws

A separate Splunk Enterprise advisory details an additional 12 vulnerabilities. Headlining these are CVE-2026-76291 and CVE-2026-76298, both rated 8.8. CVE-2026-76291 could allow a user with scheduled-search privileges to bypass security measures and execute dangerous SPL commands. CVE-2026-76298 presents a risk where a low-privileged user might derive the PostgreSQL sidecar superuser password, enabling the execution of operating system commands on search head cluster members.

Another significant flaw, CVE-2026-76293, poses a remote code execution risk. This vulnerability could allow a user possessing the edit_manager_xml capability to execute operating system commands via Splunk Web Manager XML.

Two unauthenticated denial-of-service vulnerabilities, CVE-2026-76288 and CVE-2026-76290, could render Splunk services unresponsive through maliciously crafted web requests or repeated package downloads. The remaining identified issues affect REST API authorization, field extraction management, sourcetype renaming, SPL filtering, and federated search actions.

Given Splunk’s critical role in security monitoring infrastructures, a compromised instance could have severe repercussions, including the exposure of sensitive logs, degradation of detection capabilities, or disruption of ongoing investigations. While several flaws require an authenticated user with specific capabilities, this does not diminish their potential impact. Factors such as stolen credentials, overly permissive roles, and weak internal access controls could provide the necessary access for exploitation. Furthermore, the unauthenticated denial-of-service issues demand particular attention for internet-facing systems, as they can disrupt service without requiring any user authentication.

High Severity CVEs:

Medium Severity CVEs:

What You Should Do

• Immediately Apply Patches: Update Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, or 9.4.16. Upgrade Splunk SOAR to version 8.7.0 or later. For CVE-2026-76292 and CVE-2026-76295, update Splunk Secure Gateway to 3.10.12, 3.9.26, or 3.8.73.
• Review Exposed Interfaces and User Roles: Conduct an audit of all exposed Splunk interfaces and verify that user roles and permissions adhere to the principle of least privilege.
• Disable Unused Features: If immediate patching is not feasible, mitigate risk by disabling non-essential features such as Splunk Web, Pipeline Builders, Secure Gateway, or PostgreSQL sidecar components, depending on the specific vulnerabilities relevant to your deployment. Exercise caution and verify dependencies before making changes, as this may impact functionality.
• Stay Informed: Regularly consult Splunk’s official security advisories and security news sources for the latest updates and recommendations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.