VYPR
Vypr IntelligenceAI-generatedOct 21, 2026· 12 CVEs

Splunk Enterprise: Twelve Vulnerabilities Disclosed, Including Privilege Escalation and DoS Flaws

Splunk disclosed twelve vulnerabilities in Splunk Enterprise on October 21, 2026, with several allowing privilege escalation and denial-of-service.

Key findings

  • Twelve Splunk Enterprise vulnerabilities disclosed on October 21, 2026, ranging from High to Medium severity.
  • High-severity flaws include privilege escalation via database credentials and OS command execution.
  • Denial-of-service vulnerabilities affect Splunk Web and Edge Processor functionalities.
  • Patches are available for Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, 9.4.16 and Splunk Secure Gateway versions 3.10.12, 3.9.26, 3.8.73.
  • Users with specific capabilities can bypass security controls or access unauthorized data.

On October 21, 2026, Splunk disclosed a batch of twelve vulnerabilities affecting Splunk Enterprise. The vulnerabilities, all disclosed on the same day, range in severity from medium to high, with several allowing for privilege escalation and denial-of-service conditions. These flaws impact various components of Splunk Enterprise, including its web interface, search functionalities, and database access.

Several high-severity vulnerabilities were detailed in the disclosure:

  • **CVE-2026-76298 (CVSSv3 8.8)**: This critical flaw allows a user without administrative privileges to obtain the PostgreSQL superuser password. This could lead to arbitrary operating system command execution with the privileges of the Splunk Enterprise user on search head cluster members. This vulnerability affects versions prior to 10.4.4 and 10.2.8.
  • **CVE-2026-76291 (CVSSv3 8.8)**: A user with the schedule_search capability can bypass safeguards in the scheduled search workflow. This allows for the execution of risky Search Processing Language (SPL) commands, potentially disclosing or altering sensitive Splunk Enterprise data. Versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are affected.
  • **CVE-2026-76290 (CVSSv3 7.5)**: An unauthenticated user can exploit a vulnerability in the Edge Processor package download endpoint within the Splunk Pipeline Builders app. Repeated requests can cause excessive resource consumption, potentially leading to a denial-of-service condition. This affects versions below 10.4.4, 10.2.8, and 10.0.11.
  • **CVE-2026-76288 (CVSSv3 7.5)**: An unauthenticated user can send a crafted request to the Splunk Web JavaScript logger endpoint, causing Splunk Web to become unresponsive until Splunk Enterprise is restarted. This impacts versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
  • **CVE-2026-76293 (CVSSv3 7.2)**: A user with the edit_manager_xml capability can execute arbitrary operating system commands by manipulating configuration files through the Splunk Web Manager page. This affects versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16.

Medium-severity vulnerabilities also present significant risks:

  • **CVE-2026-76297 (CVSSv3 4.2)**: An unauthenticated user can disable all federated search providers by tricking a user with the edit_federated_providers capability, temporarily disrupting data retrieval. Affected versions include those below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
  • **CVE-2026-76296 (CVSSv3 4.3)**: A user without administrative roles can manipulate sourcetype renaming configurations in unauthorized applications. This impacts versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
  • **CVE-2026-76295 (CVSSv3 4.3)**: In Splunk Enterprise and Splunk Secure Gateway, a low-privileged user can view dashboard and report listings beyond their permitted scope. This affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73.
  • **CVE-2026-76294 (CVSSv3 4.3)**: A user without administrative roles can move field extractions or transformations to unauthorized applications. This vulnerability exists in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
  • **CVE-2026-76292 (CVSSv3 6.5)**: A low-privileged user in Splunk Enterprise and Splunk Secure Gateway can access mobile alert notification data belonging to other users. This affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73.
  • **CVE-2026-76289 (CVSSv3 6.5)**: An unauthenticated user can send requests to the REST API endpoint for lookup table files, potentially making the Splunk Enterprise instance unavailable. This affects versions below 10.4.4, 10.2.8, and 10.0.11.
  • **CVE-2026-76287 (CVSSv3 5.4)**: A user with specific data management capabilities can access or delete Data Management SPL2 preview jobs and results outside their authorized scope. This impacts Splunk Enterprise versions below 10.4.4.

Splunk has released patches to address these vulnerabilities. Users are strongly advised to update to the patched versions to mitigate these risks. Specifically, versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 (depending on the specific CVE) are recommended for Splunk Enterprise. Splunk Secure Gateway users should update to versions 3.10.12, 3.9.26, or 3.8.73.

This coordinated disclosure highlights the importance of timely patching for Splunk Enterprise environments. The range of vulnerabilities, from privilege escalation to denial-of-service, underscores the need for administrators to stay current with security updates to protect their data and system integrity.

The following versions are affected:

  • Splunk Enterprise: Below 10.4.4, 10.2.8, 10.0.11, 9.4.16, and 10.4.3.
  • Splunk Secure Gateway: Below 3.10.12, 3.9.26, and 3.8.73.

Patched versions include:

  • Splunk Enterprise: 10.4.4, 10.2.8, 10.0.11, 9.4.16.
  • Splunk Secure Gateway: 3.10.12, 3.9.26, 3.8.73.

This batch of vulnerabilities underscores the critical need for Splunk Enterprise users to maintain up-to-date systems. The disclosed flaws, ranging from privilege escalation to denial-of-service, present significant risks if left unaddressed. Promptly applying the provided patches is essential for safeguarding sensitive data and ensuring the continuous operation of Splunk environments.

CVE-2026-76298, CVE-2026-76297, CVE-2026-76296, CVE-2026-76295, CVE-2026-76294, CVE-2026-76293, CVE-2026-76292, CVE-2026-76291, CVE-2026-76290, CVE-2026-76289, CVE-2026-76288, CVE-2026-76287.

AI-written article. Grounded in 12 CVE records listed below.