Splunk security advisories, August 2026

Every Splunk security advisory published in August 2026, from Splunk Security Advisories (advisory.splunk.com) + NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 110
Critical: 6
High: 40
In CISA KEV: 0

Splunk advisories published in August 2026

Aug 19, 2026
Critical [CVE-2026-76404] In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system
Critical9.1
Aug 19, 2026
Critical [CVE-2026-76312] Improper Access Control through Embedded Reports in Splunk Enterprise
Critical9.4
Aug 19, 2026
Critical [CVE-2026-76311] Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise
Critical9.4
Aug 19, 2026
Critical [CVE-2026-76310] Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise
Critical9.4
Aug 19, 2026
Critical [CVE-2025-13465 +86] Third-Party Package Updates in Splunk SOAR - August 2026
Critical
Aug 19, 2026
Critical [CVE-2024-35255 +32] Third-Party Package Updates in Splunk Enterprise - August 2026
Critical
Aug 19, 2026
High [CVE-2026-76403] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise
High7.4
Aug 19, 2026
High [CVE-2026-76402] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that compromise all relevant data sent through the connector and limited alteration of event delivery
High8.2
Aug 19, 2026
High [CVE-2026-76399] Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit
High8.1
Aug 19, 2026
High [CVE-2026-76397] Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit
High8.1
Aug 19, 2026
High [CVE-2026-76396] Improper Access Control through Scheduled Searches in Splunk AI Toolkit
High7.5
Aug 19, 2026
High [CVE-2026-76395] Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit
High8.8
Aug 19, 2026
High [CVE-2026-76394] Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
High8.3
Aug 19, 2026
High [CVE-2026-76391] Improper Privilege Management through Agent Run History in Splunk AI Toolkit
High8.3
Aug 19, 2026
High [CVE-2026-76389] Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud
High8.8
Aug 19, 2026
High [CVE-2026-76388] Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security
High8.1
Aug 19, 2026
High [CVE-2026-76387] SPL Injection through the REST API in Splunk Enterprise Security
High8.1
Aug 19, 2026
High [CVE-2026-76362] Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
High7.4
Aug 19, 2026
High [CVE-2026-76357] Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR
High7.6
Aug 19, 2026
High [CVE-2026-76356] Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR
High8.1
Aug 19, 2026
High [CVE-2026-76355] Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise
High7.5
Aug 19, 2026
High [CVE-2026-76354] Path Traversal through Search Head Clustering in Splunk Enterprise
High8.1
Aug 19, 2026
High [CVE-2026-76352] Improper Authorization through the REST API in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76351] Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway
High8.8
Aug 19, 2026
High [CVE-2026-76350] Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76344] Path Traversal through the Search Dispatch REST API in Splunk Enterprise
High7.7
Aug 19, 2026
High [CVE-2026-76338] Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise
High8.1
Aug 19, 2026
High [CVE-2026-76336] Improper Access Control through the REST API in Splunk Enterprise
High7.1
Aug 19, 2026
High [CVE-2026-76335] Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76333] Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise
High7.1
Aug 19, 2026
High [CVE-2026-76332] SPL Injection through Splunk Web in Splunk Enterprise
High7.1
Aug 19, 2026
High [CVE-2026-76331] SPL Injection through the REST API in Splunk Enterprise
High8.1
Aug 19, 2026
High [CVE-2026-76330] SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise
High7.1
Aug 19, 2026
High [CVE-2026-76325] Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise
High7.3
Aug 19, 2026
High [CVE-2026-76321] SPL Injection through Nearby Event Searches in Splunk Enterprise
High7.3
Aug 19, 2026
High [CVE-2026-76319] Remote Code Execution (RCE) through Federated Search in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76317] Path Traversal through the Lookup Configuration REST API in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76316] Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76315] Code Injection through Splunk Web Manager Configuration in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76314] Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76313] Remote Code Execution (RCE) through the REST API in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76262] Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise
High7.5
Aug 19, 2026
High [CVE-2026-76259] Improper Privilege Management on the Management Port in Splunk Enterprise for Windows
High8.8
Aug 19, 2026
High [CVE-2026-76254] SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise
High7.5
Aug 19, 2026
High [CVE-2026-76253] Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise
High8.8
Aug 19, 2026
High [CVE-2026-76251] Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud
High7.1
Aug 19, 2026
Medium [CVE-2026-76405] In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store)
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76401] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector
Medium5.9
Aug 19, 2026
Medium [CVE-2026-76400] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops
Medium5.9
Aug 19, 2026
Medium [CVE-2026-76398] Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76393] Race Condition during Model Upload through the REST API in Splunk AI Toolkit
Medium5.9
Aug 19, 2026
Medium [CVE-2026-76392] Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76390] Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud
Medium5.3
Aug 19, 2026
Medium [CVE-2026-76386] Information Disclosure through Action Parameters in Zoom app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76385] Information Disclosure through Action Parameters in Venafi app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76384] Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76383] Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76382] Information Disclosure through Action Parameters in Phantom app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76381] Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76380] Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76379] Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76378] Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76377] Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76376] Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76375] Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOAR
Medium5.0
Aug 19, 2026
Medium [CVE-2026-76374] Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76373] Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76370] Information Disclosure through the REST API in Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76367] Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR
Medium4.0
Aug 19, 2026
Medium [CVE-2026-76366] Information Disclosure through the REST API in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76365] Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76364] Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76363] Structured Query Language Injection through the REST API in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76360] Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76359] Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76358] Path Traversal through App Installation Tar Extraction in Splunk SOAR
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76353] Path Traversal through Knowledge Bundle Replication in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76349] SPL Injection through Splunk Web Form Tokens in Splunk Enterprise
Medium6.4
Aug 19, 2026
Medium [CVE-2026-76347] Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76346] Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76345] Remote Code Execution (RCE) through the REST API in Splunk Enterprise
Medium6.0
Aug 19, 2026
Medium [CVE-2026-76343] Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise
Medium6.5
Aug 19, 2026
Medium [CVE-2026-76342] Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76341] Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76340] Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise
Medium5.3
Aug 19, 2026
Medium [CVE-2026-76339] SPL Injection through the geostats Command in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76337] Path Traversal through Splunk Web Static File Serving in Splunk Enterprise
Medium5.3
Aug 19, 2026
Medium [CVE-2026-76334] SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise
Medium6.4
Aug 19, 2026
Medium [CVE-2026-76329] SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise
Medium6.4
Aug 19, 2026
Medium [CVE-2026-76328] SPL Injection through Splunk Web in Splunk Enterprise
Medium6.7
Aug 19, 2026
Medium [CVE-2026-76327] SPL Injection through Splunk Web in Splunk Secure Gateway
Medium6.4
Aug 19, 2026
Medium [CVE-2026-76326] Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise
Medium5.7
Aug 19, 2026
Medium [CVE-2026-76324] Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise
Medium5.7
Aug 19, 2026
Medium [CVE-2026-76323] SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise
Medium6.4
Aug 19, 2026
Medium [CVE-2026-76322] SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise
Medium6.7
Aug 19, 2026
Medium [CVE-2026-76320] SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise
Medium5.9
Aug 19, 2026
Medium [CVE-2026-76318] Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise
Medium5.7
Aug 19, 2026
Medium [CVE-2026-76309] Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise
Medium4.3
Aug 19, 2026
Medium [CVE-2026-76263] Improper Access Control through the REST API in Splunk Enterprise
Medium5.4
Aug 19, 2026
Medium [CVE-2026-76261] Insecure Default Access Control List through the REST API in Splunk Secure Gateway
Medium5.3

Page 1 of 2 · 100 of 110

Get an email when Splunk publishes the next one.

See Splunk's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Splunk

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.