Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9.3 to 9.9.

Splunk published the fixes on October 21, 2026, across three advisories covering access control, input handling, exposed files, remote code execution, denial of service, and weak authorization checks.

The Splunk Enterprise security hardening advisory covers four CVEs found internally. CVE-2026-76299 and CVE-2026-76302 both have a 9.9 score and involve improper access control and improper neutralization.

CVE-2026-76300, scored 8.8, concerns poor control of a resource during its lifetime, while CVE-2026-76301 carries a 7.6 score for a protection failure. Splunk groups internal findings by weakness type so that each CVE may represent more than one related issue.

The Splunk SOAR advisory lists eight CVEs fixed in version 8.7.0. The most serious is CVE-2026-76531, rated 9.9, which may leave files or directories open to outside parties.

CVE-2026-76407 is another critical issue with a 9.3 score and involves improper access control. Other SOAR flaws include unsafe URL path checks, poor input handling, weak resource controls, and protection failures.

Critical Severity :

CVE	Product	CVSS	CWE
CVE-2026-76299	Splunk Enterprise	9.9	CWE-284
CVE-2026-76302	Splunk Enterprise	9.9	CWE-707
CVE-2026-76407	Splunk SOAR	9.3	CWE-284
CVE-2026-76531	Splunk SOAR	9.9	CWE-552

Splunk Fixes 24 Security Flaws

A separate Splunk Enterprise advisory details 12 more flaws, led by CVE-2026-76291 and CVE-2026-76298 at 8.8. The first could let a user with scheduled-search rights bypass safeguards and run risky SPL commands.

The second could allow a low-privileged user to derive the PostgreSQL sidecar superuser password and run operating system commands on search head cluster members.

CVE-2026-76293 also creates a remote code execution risk. A user with the edit_manager_xml capability could run operating system commands through Splunk Web Manager XML.

High Severity :

CVE	Product	CVSS	CWE
CVE-2026-76291	Splunk Enterprise	8.8	CWE-284
CVE-2026-76298	Splunk Enterprise	8.8	CWE-321
CVE-2026-76300	Splunk Enterprise	8.8	CWE-664
CVE-2026-76408	Splunk SOAR	8.8	CWE-664
CVE-2026-76526	Splunk SOAR	8.8	CWE-707
CVE-2026-76530	Splunk SOAR	8.8	CWE-647
CVE-2026-76301	Splunk Enterprise	7.6	CWE-693
CVE-2026-76288	Splunk Enterprise	7.5	CWE-400
CVE-2026-76290	Splunk Enterprise	7.5	CWE-400
CVE-2026-76529	Splunk SOAR	7.5	CWE-424
CVE-2026-76293	Splunk Enterprise	7.2	CWE-94

Two unauthenticated denial-of-service bugs, CVE-2026-76288 and CVE-2026-76290, could make Splunk services stop responding through crafted web requests or repeated package downloads.

The remaining issues affect REST API authorization, field extraction management, sourcetype renaming, SPL filtering, and federated search actions.

Because Splunk often sits at the center of security monitoring, a compromised instance could expose logs, weaken detection, or disrupt investigations. Several flaws require an authenticated user with capabilities, but that does not make them harmless.

Stolen accounts, excessive role permissions, and weak internal access rules could provide the access needed. The unauthenticated denial-of-service issues deserve attention on internet-facing systems because they can affect service without an account.

Medium Severity :

CVE	Product	CVSS	CWE
CVE-2026-76289	Splunk Enterprise	6.5	CWE-770
CVE-2026-76292	Enterprise and Secure Gateway	6.5	CWE-862
CVE-2026-76528	Splunk SOAR	6.2	CWE-693
CVE-2026-76527	Splunk SOAR	5.5	CWE-703
CVE-2026-76287	Splunk Enterprise	5.4	CWE-639
CVE-2026-76294	Splunk Enterprise	4.3	CWE-862
CVE-2026-76295	Enterprise and Secure Gateway	4.3	CWE-943
CVE-2026-76296	Splunk Enterprise	4.3	CWE-862
CVE-2026-76297	Splunk Enterprise	4.2	CWE-352

Organizations should review exposed interfaces and user roles while scheduling the updates. Administrators should upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 and move Splunk SOAR to 8.7.0 or later. Splunk also says CVE-2026-76292 and CVE-2026-76295 need Splunk Secure Gateway updates to 3.10.12, 3.9.26, or 3.8.73.

Teams unable to patch at once can reduce exposure by turning off unused Splunk Web, Pipeline Builders, Secure Gateway, or PostgreSQL sidecar features, depending on the flaw.

These steps can affect key functions, so administrators should review dependencies before making changes. Readers can also review earlier Cyber Security News coverage of multiple Splunk Enterprise vulnerabilities and Splunk SOAR security updates for wider patch history and risk context.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR appeared first on Cyber Security News.