Cisco CVEs, last 30 days (115 CVEs)
CVE Title CVSS Type Status CVE-2026-76519 A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrar... 9.8 Unknown/Unlisted Weakness Exploited CVE-2026-76418 A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defens... 8.6 Unknown/Unlisted Weakness Exploited CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.9 Unknown/Unlisted Weakness Not exploited CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.9 Unknown/Unlisted Weakness Not exploited CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.9 Unknown/Unlisted Weakness Not exploited CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76407 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76527 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76528 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76529 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76474 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 9.8 Improper Authentication Not exploited CVE-2026-76466 A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expres... 9.8 Use of Hard-coded Credentials Not exploited CVE-2026-76473 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76475 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 9.3 Cross-site Scripting (XSS) Not exploited CVE-2026-9827 A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Path Traversal Not exploited CVE-2026-9869 A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-9659 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B202... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B202... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 OS Command Injection Not exploited CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 OS Command Injection Not exploited CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. 9.1 OS Command Injection Not exploited CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. 9.1 OS Command Injection Not exploited CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.132... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1... 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 OS Command Injection Not exploited CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10137 A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10138 A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 OS Command Injection Not exploited CVE-2026-10139 A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10141 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-10131 An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 OS Command Injection Not exploited CVE-2026-10132 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-20043 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a c... 9.0 Unknown/Unlisted Weakness Not exploited CVE-2026-11316 A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-12573 Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands... 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76526 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76298 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database... 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76291 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected ... 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76476 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 8.8 Improper Input Validation Not exploited CVE-2026-76477 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 8.8 SQL Injection Not exploited CVE-2026-76478 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 8.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76490 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 8.6 Unknown/Unlisted Weakness Not exploited CVE-2026-9535 A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). 8.2 Out-of-bounds Read Not exploited CVE-2026-95646 Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP config... 8.0 Unknown/Unlisted Weakness Not exploited CVE-2026-76495 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76524 A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to exe... 7.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76494 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.8 Code Injection Not exploited CVE-2026-76479 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 7.8 Path Traversal Not exploited CVE-2026-20291 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a c... 7.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76506 A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code executi... 7.6 Path Traversal Not exploited CVE-2026-9536 A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-8822 A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-8824 A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-41216 An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-42057 An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76306 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer pass... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScrip... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download end... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76505 A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as... 7.5 Improper Input Validation Not exploited CVE-2026-76491 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76492 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76493 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76481 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Depl... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-20236 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a c... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-20356 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a c... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API ... 7.2 Unknown/Unlisted Weakness Not exploited CVE-2026-76293 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary o... 7.2 Code Injection Not exploited CVE-2026-76496 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 7.0 Unknown/Unlisted Weakness Not exploited CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived da... 6.9 Cross-site Scripting (XSS) Not exploited CVE-2026-76497 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehen... 6.6 Unknown/Unlisted Weakness Not exploited CVE-2026-76308 In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API a... 6.5 Missing Authorization Not exploited CVE-2026-76305 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. 6.5 Missing Authorization Not exploited CVE-2026-76292 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged ... 6.5 Missing Authorization Not exploited CVE-2026-76289 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Ente... 6.5 Unknown/Unlisted Weakness Not exploited CVE-2026-76419 A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Mana... 6.1 Cross-site Scripting (XSS) Not exploited CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic a... 5.9 Unknown/Unlisted Weakness Not exploited CVE-2026-76489 Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker ... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20179 Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated,... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20197 Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20218 A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attack... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20221 Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine ... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20011 Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-20019 Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause th... 5.8 Unknown/Unlisted Weakness Not exploited CVE-2026-76303 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays... 5.7 Cross-site Scripting (XSS) Not exploited CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). 5.6 Unknown/Unlisted Weakness Not exploited CVE-2026-76462 A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local... 5.5 Improper Input Validation Not exploited CVE-2026-76287 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job c... 5.4 Unknown/Unlisted Weakness Not exploited CVE-2026-20241 A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthe... 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-40063 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-76487 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could ... 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-76435 A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-76445 Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detect... 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-20183 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of t... 4.3 Unknown/Unlisted Weakness Not exploited CVE-2026-11315 A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). 4.3 Out-of-bounds Read Not exploited CVE-2026-76304 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Au... 4.3 Missing Authorization Not exploited CVE-2026-76294 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractio... 4.3 Missing Authorization Not exploited CVE-2026-76295 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does n... 4.3 Unknown/Unlisted Weakness Not exploited CVE-2026-76296 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, ... 4.3 Missing Authorization Not exploited CVE-2026-76297 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_pr... 4.2 Cross-Site Request Forgery (CSRF) Not exploited