Splunk Enterprise: Batch of Twelve Vulnerabilities Disclosed, Including DoS and Privilege Escalation Flaws
Key findings • Twelve Splunk Enterprise vulnerabilities disclosed on October 21, 2026, ranging from High to Medium severity. • CVE-2026-76289 allows unauthorized users to cause a denial-of-se…
Key findings
- Twelve Splunk Enterprise vulnerabilities disclosed on October 21, 2026, ranging from High to Medium severity.
- CVE-2026-76289 allows unauthorized users to cause a denial-of-service via the REST API.
- CVE-2026-76288 allows unauthenticated users to cause Splunk Web to stop responding via a crafted request.
- Patches are available for Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, 9.4.16 and Splunk Secure Gateway versions 3.10.12, 3.9.26, 3.8.73.
On October 21, 2026, Splunk disclosed a batch of twelve vulnerabilities affecting Splunk Enterprise. The vulnerabilities, all disclosed on the same day, range in severity from medium to high, with several allowing for privilege escalation and denial-of-service conditions. These disclosures stem from Cisco's internal security review, as noted in CVE-2026-76407.
Two of these vulnerabilities, CVE-2026-76289 and CVE-2026-76288, specifically impact Splunk Enterprise instances running versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
CVE-2026-76289, a medium-severity vulnerability (CVSSv3 6.5), allows a user without administrative privileges to render the Splunk Enterprise instance unavailable to other users. This is achieved by sending a crafted request to the Representational State Transfer (REST) API endpoint for lookup table files.
The high-severity CVE-2026-76288 (CVSSv3 7.5) enables an unauthenticated user to cause Splunk Web to cease responding to requests by sending a single malicious request to the Splunk Web JavaScript logger endpoint. This denial-of-service condition persists until the Splunk Enterprise service is restarted.
These disclosures were part of a larger set of twelve vulnerabilities announced by Splunk on the same day, as reported by Vypr Intelligence. The batch included other high-severity flaws related to privilege escalation and OS command execution, as well as denial-of-service vulnerabilities affecting Splunk Web and Edge Processor functionalities.
Splunk has released patches for these vulnerabilities. Affected versions of Splunk Enterprise include those below 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Patched versions are 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Splunk Secure Gateway versions 3.10.12, 3.9.26, and 3.8.73 also received patches.
Users are advised to update their Splunk Enterprise instances to the latest available versions to mitigate these risks. The coordinated disclosure of these vulnerabilities highlights the importance of timely patching and security reviews for enterprise software. CVE-2026-76407 is a general reference to the software hardening release addressing multiple internally discovered vulnerabilities. The specific details of CVE-2026-76407 are not fully elaborated in the provided text, but it is linked to Cisco's security review. The batch of twelve vulnerabilities underscores the need for continuous vigilance in maintaining the security posture of critical infrastructure components like Splunk Enterprise. The Vypr Intelligence report indicates that some vulnerabilities could allow bypassing security controls or accessing unauthorized data. The timely release of patches by Splunk addresses these concerns, but prompt application by users remains crucial.