Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR

Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9.3 to 9.9.

Splunk published the fixes on October 21, 2026, across three advisories covering access control, input handling, exposed files, remote code execution, denial of service, and weak authorization checks.

The Splunk Enterprise security hardening advisory covers four CVEs found internally. CVE-2026-76299 and CVE-2026-76302 both have a 9.9 score and involve improper access control and improper neutralization.

CVE-2026-76300, scored 8.8, concerns poor control of a resource during its lifetime, while CVE-2026-76301 carries a 7.6 score for a protection failure. Splunk groups internal findings by weakness type so that each CVE may represent more than one related issue.

The Splunk SOAR advisory lists eight CVEs fixed in version 8.7.0. The most serious is CVE-2026-76531, rated 9.9, which may leave files or directories open to outside parties.

CVE-2026-76407 is another critical issue with a 9.3 score and involves improper access control. Other SOAR flaws include unsafe URL path checks, poor input handling, weak resource controls, and protection failures.

Critical Severity :

Splunk Fixes 24 Security Flaws

A separate Splunk Enterprise advisory details 12 more flaws, led by CVE-2026-76291 and CVE-2026-76298 at 8.8. The first could let a user with scheduled-search rights bypass safeguards and run risky SPL commands.

The second could allow a low-privileged user to derive the PostgreSQL sidecar superuser password and run operating system commands on search head cluster members.

CVE-2026-76293 also creates a remote code execution risk. A user with the edit_manager_xml capability could run operating system commands through Splunk Web Manager XML.

High Severity :

Two unauthenticated denial-of-service bugs, CVE-2026-76288 and CVE-2026-76290, could make Splunk services stop responding through crafted web requests or repeated package downloads.

The remaining issues affect REST API authorization, field extraction management, sourcetype renaming, SPL filtering, and federated search actions.

Because Splunk often sits at the center of security monitoring, a compromised instance could expose logs, weaken detection, or disrupt investigations. Several flaws require an authenticated user with capabilities, but that does not make them harmless.

Stolen accounts, excessive role permissions, and weak internal access rules could provide the access needed. The unauthenticated denial-of-service issues deserve attention on internet-facing systems because they can affect service without an account.

Medium Severity :

Organizations should review exposed interfaces and user roles while scheduling the updates. Administrators should upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 and move Splunk SOAR to 8.7.0 or later. Splunk also says CVE-2026-76292 and CVE-2026-76295 need Splunk Secure Gateway updates to 3.10.12, 3.9.26, or 3.8.73.

Teams unable to patch at once can reduce exposure by turning off unused Splunk Web, Pipeline Builders, Secure Gateway, or PostgreSQL sidecar features, depending on the flaw.

These steps can affect key functions, so administrators should review dependencies before making changes. Readers can also review earlier Cyber Security News coverage of multiple Splunk Enterprise vulnerabilities and Splunk SOAR security updates for wider patch history and risk context.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR appeared first on Cyber Security News.