Splunk Enterprise and SOAR Patched for 24 Vulnerabilities, Including Four Critical Flaws
Splunk has released security updates addressing 24 vulnerabilities in its Enterprise and SOAR platforms, with four critical flaws posing significant risks.
Splunk has issued critical security patches for a total of 24 vulnerabilities affecting its Splunk Enterprise and Splunk SOAR platforms. The updates, released on October 21, 2026, address a range of issues including improper access control, improper neutralization of input, exposed files, remote code execution, denial of service, and weak authorization checks.
Four of the vulnerabilities are classified as critical, with CVSS scores ranging from 9.3 to 9.9. In Splunk Enterprise, two critical flaws (CVE-2026-76299 and CVE-2026-76302), both with a CVSS score of 9.9, stem from improper access control and improper neutralization of input, respectively. Another critical vulnerability in Splunk Enterprise, CVE-2026-76300 (CVSS 8.8), relates to poor control of a resource during its lifetime, while CVE-2026-76301 (CVSS 7.6) is a protection failure.
Splunk SOAR also faces critical threats, with CVE-2026-76531 (CVSS 9.9) allowing sensitive files or directories to be exposed to unauthorized parties. Additionally, CVE-2026-76407 (CVSS 9.3) involves improper access control. The company groups internal findings by weakness type, meaning each CVE may represent multiple related issues.
Beyond the critical flaws, Splunk Enterprise has 12 other vulnerabilities addressed, including two high-severity issues: CVE-2026-76291 and CVE-2026-76298, both rated 8.8. CVE-2026-76291 could permit a user with scheduled-search privileges to bypass security measures and execute dangerous SPL commands. CVE-2026-76298, on the other hand, could enable a low-privileged user to extract the PostgreSQL sidecar superuser password, potentially leading to operating system command execution on search head cluster members. CVE-2026-76293 also presents a remote code execution risk.
Two unauthenticated denial-of-service vulnerabilities, CVE-2026-76288 and CVE-2026-76290, are also patched. These flaws could cause Splunk services to become unresponsive through specially crafted web requests or repeated package downloads, posing a risk to internet-facing systems.
Organizations using Splunk Enterprise are advised to update to version 10.4.4 or later, specifically 10.4.4, 10.2.8, 10.0.11, or 9.4.16. For Splunk SOAR, the recommended update is to version 8.7.0 or later. Updates for Splunk Secure Gateway to versions 3.10.12, 3.9.26, or 3.8.73 are also necessary for CVE-2026-76292 and CVE-2026-76295.
For organizations unable to patch immediately, Splunk suggests mitigating exposure by disabling unused features such as Splunk Web, Pipeline Builders, Secure Gateway, or the PostgreSQL sidecar, depending on the specific vulnerabilities affecting their environment. However, these measures may impact core functionalities, requiring careful review of dependencies.
Given Splunk's central role in security monitoring, compromised instances can lead to the exposure of sensitive logs, weakened detection capabilities, and disruption of incident investigations. The presence of vulnerabilities requiring authenticated access does not diminish the threat, as stolen credentials or excessive permissions can provide the necessary entry points.