Splunk

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 9.8CriticalJun 18, 2026Splunk Enterprise Auth bypass / access controlCVE-2026-20253Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.Added to KEV Jun 18, 2026Exploited97% likelyExploit codeNucleiDetection

Recent

• –UnscoredOct 22, 2026SplunkADV-cccs-106f13d80ca7Serial number: AV26-1077 Date: October 22, 2026 As of October 21, 2026, Splunk is affected by vulnerabilities in the following products: Splunk Enterprise Prior to 10.0.11 Prior to 10.2.8 Prior to 10.4.4 Prior to 9.4.16 Splunk SOAR Prior to 8.7.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Hardening in Splunk Enterprise - October 2026 Security Vulnerabilities in Splunk SOAR - October 2026
• –UnscoredOct 21, 2026Splunk SOARCVE-2026-76527As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76527 are related to improper check or handling of exceptional conditions and are grouped under the Common Weakness Enumeration (CWE) CWE-703.
• 8.8HighOct 21, 2026Splunk SOARCVE-2026-76526As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
• 5.9MediumOct 21, 2026Splunk SOAR Information disclosureCVE-2026-76406In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data
• 6.5MediumOct 21, 2026Splunk SOAR Auth bypass / access controlCVE-2026-76308In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splun
• 6.5MediumOct 21, 2026Splunk SOAR Auth bypass / access controlCVE-2026-76305In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/d
• 4.3MediumOct 21, 2026Splunk SOAR Auth bypass / access controlCVE-2026-76304In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator (URL) of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit perm
• 9.8CriticalOct 21, 2026Splunk EnterpriseCVE-2026-76301As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76301 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.
• 8.8HighOct 21, 2026Splunk EnterpriseCVE-2026-76300As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.
• 8.8HighOct 21, 2026Splunk Enterprise Crypto / certificateCVE-2026-76298In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members. The vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs. For more informat
• 4.2MediumOct 21, 2026Splunk Enterprise CSRFCVE-2026-76297In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets. The vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider st
• 4.3MediumOct 21, 2026Splunk Enterprise Auth bypass / access controlCVE-2026-76296In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations. For more information see Rename source types at search
• 7.2HighOct 21, 2026Splunk Enterprise Code / command injectionCVE-2026-76293In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
• 8.8HighOct 21, 2026Splunk Enterprise Auth bypass / access controlCVE-2026-76291In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to sched
• –UnscoredOct 7, 2026splunk Auth bypass / access controlCVE-2026-76281As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76281 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
• 9.8CriticalOct 7, 2026Splunk Enterprise Auth bypass / access controlCVE-2026-76268In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerabil1.6% likelyExploit codeNucleiDetection
• 8.8HighAug 19, 2026splunk SSRFCVE-2026-76351In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a pass
• 5.4MediumAug 19, 2026splunk SSRFCVE-2026-76347In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate
• 6.4MediumAug 19, 2026splunk SQL injectionCVE-2026-76327In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "sc_admin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator (URL). The resulting dashboard searches could run arbitrary Search Processing Language (SPL) commands with the permissions available to the affected user. The commands could expose all relevant data available
• 9.8CriticalJun 18, 2026Splunk Enterprise Auth bypass / access controlCVE-2026-20253Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.Exploited97% likelyExploit codeNucleiDetection

See every Splunk entry on the dashboard.

Top products

• Splunk Enterprise8 CVEs in the last year, 2 critical
• Splunk SOAR6 CVEs in the last year
• splunk4 CVEs in the last year
• Enterprise1 CVE in the last year, 1 critical, 1 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 22, 2026Splunk security advisory (AV26-1077)ADV-cccs-106f13d80ca7