Splunk Enterprise and SOAR fix critical flaws scoring up to 9.9

Splunk Enterprise and SOAR fix critical flaws scoring up to 9.9

21 October 2026: Splunk has published its October security release for Splunk Enterprise and Splunk SOAR, with two Critical hardening advisories whose worst findings score 9.9 under CVSS 3.1. The fixes are in Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 and SOAR 8.7.0, which Splunk had pre-announced a week earlier; it lists no workaround for the hardening findings and says nothing about exploitation.

Fixed versions

Product	Affected	Fixed
Splunk Enterprise 10.4	10.4.0 to 10.4.3	10.4.4
Splunk Enterprise 10.2	10.2.0 to 10.2.7	10.2.8
Splunk Enterprise 10.0	10.0.0 to 10.0.10	10.0.11
Splunk Enterprise 9.4	9.4.0 to 9.4.15	9.4.16
Splunk SOAR	8.7 below 8.7.0	8.7.0

Two lower-rated issues also need Splunk Secure Gateway at 3.10.12, 3.9.26 or 3.8.73 or later.

The hardening findings

The two Critical advisories group findings Splunk's own team identified under broad weakness categories, with each CVE scored at its worst finding. For Enterprise (SVD-2026-1008) they are CVE-2026-76299 (9.9, improper access control), CVE-2026-76302 (9.9, improper neutralisation of input), CVE-2026-76300 (8.8) and CVE-2026-76301 (7.6). For SOAR (SVD-2026-1011) the worst are CVE-2026-76531 (9.9, files or directories reachable by outside parties) and CVE-2026-76407 (9.3, improper access control), with three more at 8.8, including authorisation decisions made on non-canonical URL paths. Splunk publishes no detail beyond the categories, so the version number is the only thing to check.

Specific flaws worth reading before patching

The Enterprise advisory SVD-2026-1007 describes individual bugs, several with workarounds:

• CVE-2026-76298 (8.8): a low-privileged user can derive the superuser password of the PostgreSQL sidecar from a search head cluster identifier that appears in search job logs, then run operating system commands on cluster members. Disabling the sidecar in server.conf blocks it but breaks Edge Processor, OpAmp and SPL2 pipelines.
• CVE-2026-76288 (7.5): one unauthenticated request to the Splunk Web JavaScript logger endpoint makes Splunk Web unresponsive until a restart; turning off Splunk Web is the stopgap.
• CVE-2026-76290 (7.5): unauthenticated requests to the Edge Processor package download endpoint can exhaust memory and stop the Splunk daemon; after upgrading, administrators must also switch on authentication for package downloads.
• CVE-2026-76291 (8.8) and CVE-2026-76293 (7.2): users with the schedule_search or edit_manager_xml capabilities can bypass safeguards on risky search commands or run operating system commands.

Several of these depend on a role a user already holds, so a capability review alongside the upgrade is worthwhile. In SOAR, advisory SVD-2026-1010 adds a flaw that let an Observer-role user infer other users' password hashes and tokens through REST API filters. Splunk is the system that holds an organisation's security logs, which makes it a target in its own right. Our SIEM software category lists 15 products and our log management category 11.

Related on TrustList:

• Fortinet patches SQL injection in FortiAnalyzer, FortiManager, FortiMail
• Cribl buys observability startup Tero and names Ben Johnson a VP
• Elastic patches 14 flaws across Elasticsearch, Kibana and Endpoint

Sources

• Splunk: SVD-2026-1008, Security Hardening in Splunk Enterprise, October 2026, 21 October 2026
• Splunk: SVD-2026-1007, Splunk Enterprise Security Vulnerabilities, 21 October 2026
• Splunk: SVD-2026-1011, Security Hardening in Splunk SOAR, October 2026, 21 October 2026
• Splunk: SVD-2026-1010, Security Vulnerabilities in Splunk SOAR, 21 October 2026