Splunk Fixes 31 Vulnerabilities in Enterprise and SOAR, Three Rated CVSS 9.9

TL;DR

Splunk published four advisories fixing 31 Splunk vulnerabilities in Splunk Enterprise and Splunk SOAR. Three of the flaws carry a critical CVSS score of 9.9. Admins should upgrade to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16, and to Splunk SOAR 8.7.0.

Notable CVEs

Why It Matters

Splunk sits at the center of many security operations centers. It collects logs, and Splunk SOAR runs automated response playbooks. As a result, a compromise could blind defenders or hand attackers control of response tools.

Notably, Splunk describes the hardening findings as “internally identified,” so its own teams found them before outside reports. That gives defenders a head start, but only if they patch.

How the Attacks Work

Security hardening releases

Two advisories group internally found bugs by weakness type, with one CVE per group. Each score reflects “the highest CVSS score among those findings.” The Splunk SOAR hardening advisory lists eight CVEs. The top one, CVE-2026-76531 (CVSS 9.9), covers files or directories exposed to outside parties.

Meanwhile, the Splunk Enterprise hardening advisory lists four CVEs. Two reach CVSS 9.9: CVE-2026-76299 for improper access control and CVE-2026-76302 for improper neutralization. Splunk does not describe the individual bugs inside each group.

Individually disclosed flaws

The Splunk Enterprise vulnerabilities advisory covers 12 more CVEs. The most serious include:

• CVE-2026-76291 (8.8): improper access control in scheduled search safeguards.
• CVE-2026-76298 (8.8): a hard-coded cryptographic key in the PostgreSQL sidecar service.
• CVE-2026-76293 (7.2): remote code execution through Splunk Web Manager XML.
• CVE-2026-76288 and CVE-2026-76290 (7.5): denial of service flaws, one through unauthenticated package downloads.

Separately, the Splunk SOAR vulnerabilities advisory fixes seven bugs. These include two REST API query filter leaks rated 7.5 and 7.2, plus stored XSS through app documentation. Other SOAR fixes close missing authorization checks during app downloads and in the REST API.

Exploitation status

Splunk does not report exploitation in the wild, and no public proof-of-concept has been confirmed. None of these Splunk vulnerabilities appears in CISA’s Known Exploited Vulnerabilities catalog.

Affected Versions

• Splunk Enterprise 10.4.0 to 10.4.3, 10.2.0 to 10.2.7, 10.0.0 to 10.0.10 and 9.4.0 to 9.4.15
• Splunk SOAR below 8.7.0

Patch and Mitigation Steps

• Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16.
• Upgrade Splunk SOAR to 8.7.0 or higher.
• Follow the extra steps Splunk lists for Splunk Secure Gateway flaws CVE-2026-76292 and CVE-2026-76295.
• Limit Splunk Web and REST API access to trusted networks.

Given the three critical scores, teams should treat these Splunk vulnerabilities as a priority patch.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.