Splunk Enterprise: 25 Vulnerabilities Disclosed Together, Affecting Multiple Versions
Key findings • 25 vulnerabilities disclosed simultaneously for Splunk Enterprise on August 19, 2026. • Flaws impact multiple versions, with patches available in 10.4.2, 10.2.6, 10.0.9, and 9.…
Key findings
- 25 vulnerabilities disclosed simultaneously for Splunk Enterprise on August 19, 2026.
- Flaws impact multiple versions, with patches available in 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
- Vulnerabilities include REST API abuse, file manipulation, and SPL injection, with High severity ratings.
- Splunk Secure Gateway is also affected by several of these vulnerabilities.
- Users are urged to update immediately to mitigate risks of unauthorized access and system disruption.
On August 19, 2026, a significant batch of 25 vulnerabilities was disclosed for Splunk Enterprise, impacting various versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities, ranging in severity from Low to High, were disclosed together, indicating a coordinated disclosure event. The vulnerabilities primarily revolve around improper access controls and injection flaws within Splunk's REST API, file system operations, and search processing language (SPL) execution, potentially allowing unauthenticated or lower-privileged users to gain unauthorized access, modify system integrity, or disrupt service availability.
Several vulnerabilities center on the abuse of Splunk's Representational State Transfer (REST) API. CVE-2026-76355, a High severity flaw, allows unauthenticated users to retrieve Edge Processor pipeline configurations. CVE-2026-76354 and CVE-2026-76344, both High severity, permit users without admin or power roles to delete or overwrite files, or write dispatch metadata to arbitrary locations, respectively, by sending crafted REST API requests. Additionally, CVE-2026-76340, a Medium severity vulnerability, allows unauthenticated users to reload token-signing keys via the REST API in specific 10.4.x versions.
Other vulnerabilities exploit Splunk's search and reporting capabilities. CVE-2026-76352 (High) allows users to create or modify scripted lookups, executing arbitrary scripts with the permissions of the Splunk Enterprise service account. CVE-2026-76350 (High) enables users with the schedule_search capability to embed malicious SPL in PDF attachments for email alerts, which could be executed when the alert runs. CVE-2026-76349 (Medium) allows unauthenticated users to trick authenticated users into running arbitrary SPL commands via crafted Splunk Web links. Furthermore, CVE-2026-76339 (Medium) permits users to inject SPL commands through the geostats command, which are then executed with the permissions of another authenticated user. CVE-2026-76331 (High) allows lower-privileged users to inject SPL into saved-search dispatch requests, potentially leading to unauthorized data access and system integrity issues.
A subset of the disclosed vulnerabilities also impacts Splunk Secure Gateway. CVE-2026-76351 (High) involves crafted report notification data that could cause Splunk Secure Gateway to send a request to the Splunk Enterprise REST API. CVE-2026-76347 (Medium) describes a Server-Side Request Forgery (SSRF) in report notifications that could allow system-authenticated requests to internal Splunk endpoints.
The batch also includes vulnerabilities related to file manipulation and cross-site scripting (XSS). CVE-2026-76353 (Medium) allows users to delete arbitrary files on a cluster manager via crafted knowledge bundle deltas. CVE-2026-76335 (High) enables authenticated users without specific capabilities to write malicious XML configurations that could lead to Splunk Enterprise executing arbitrary code when the affected page is opened. CVE-2026-76346 (Medium) allows a user with the "power" role to store malicious JavaScript in dashboard sparkline options, which executes in the browser of another user viewing the dashboard if that user has the "admin" role. Similarly, CVE-2026-76334 (Medium) and CVE-2026-76333 (High) involve malicious SPL or crafted URLs within Dashboard Studio workflow actions that can be triggered by other authenticated users. CVE-2026-76332 (High) allows unauthenticated users to trick authenticated users into opening crafted links to Analytics Workspace, leading to the execution of attacker-controlled SPL. CVE-2026-76338 (High) details how an unauthenticated user with a trusted distributed search private key could forge administrative session tokens. Lastly, CVE-2026-76337 (Medium) allows unauthenticated users to read JavaScript files outside the Splunk Web static directory due to insufficient restrictions on static file requests.
The patched versions for these vulnerabilities are primarily 10.4.2, 10.2.6, 10.0.9, and 9.4.14 for Splunk Enterprise, and specific versions for Splunk Secure Gateway (3.10.9, 3.9.23, and 3.8.70). Users are strongly advised to update to the latest available versions to mitigate these risks. The coordinated disclosure of these numerous vulnerabilities underscores the importance of timely patching and security reviews for Splunk Enterprise deployments.
This extensive disclosure highlights potential weaknesses in Splunk Enterprise's security posture, particularly concerning access control and input validation across its various components and APIs. Users should prioritize updating their Splunk Enterprise and Splunk Secure Gateway instances to the patched versions to protect against these diverse attack vectors. The sheer number and variety of vulnerabilities disclosed simultaneously suggest a thorough review of the product's security by the researchers involved.
The vulnerabilities patched include: CVE-2026-76355, CVE-2026-76354, CVE-2026-76353, CVE-2026-76352, CVE-2026-76351, CVE-2026-76350, CVE-2026-76349, CVE-2026-76348, CVE-2026-76347, CVE-2026-76346, CVE-2026-76345, CVE-2026-76344, CVE-2026-76343, CVE-2026-76342, CVE-2026-76341, CVE-2026-76340, CVE-2026-76339, CVE-2026-76338, CVE-2026-76337, CVE-2026-76336, CVE-2026-76335, CVE-2026-76334, CVE-2026-76333, CVE-2026-76332, CVE-2026-76331.