Splunk security advisories, October 2026

Every Splunk security advisory published in October 2026, from Splunk Security Advisories (advisory.splunk.com) + NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 56
Critical: 14
High: 13
In CISA KEV: 1
CVEs: 175

Splunk advisories published in October 2026

Oct 28, 2026
Advisory [CVE-2026-105482 +3] Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
UnratedExploitedCISA KEV
Oct 21, 2026
Critical [CVE-2026-76531] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.9
Oct 21, 2026
Critical [CVE-2026-76529] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76528] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76527] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76408] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76407] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76302] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.9
Oct 21, 2026
Critical [CVE-2026-76301] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 21, 2026
Critical [CVE-2026-76299] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.9
Oct 21, 2026
Critical [CVE-2025-61726 +30] Third-Party Package Updates in Splunk Enterprise - October 2026
Critical
Oct 21, 2026
High [CVE-2026-76530] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
High8.8
Oct 21, 2026
High [CVE-2026-76526] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
High8.8
Oct 21, 2026
High [CVE-2026-76307] In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users
High7.2
Oct 21, 2026
High [CVE-2026-76306] In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users
High7.5
Oct 21, 2026
High [CVE-2026-76300] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
High8.8
Oct 21, 2026
High [CVE-2026-76298] In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members
High8.8
Oct 21, 2026
High [CVE-2026-76293] In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page
High7.2
Oct 21, 2026
High [CVE-2026-76291] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow
High8.8
Oct 21, 2026
High [CVE-2026-76290] In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app
High7.5
Oct 21, 2026
High [CVE-2026-76288] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests
High7.5
Oct 21, 2026
High [CVE-2024-34062 +48] Third-Party Package Updates in Splunk SOAR - October 2026
High
Oct 21, 2026
Medium [CVE-2026-76406] In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data
Medium5.9
Oct 21, 2026
Medium [CVE-2026-76308] Splunk Enterprise: In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change
Medium6.5
Oct 21, 2026
Medium [CVE-2026-76305] In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app
Medium6.5
Oct 21, 2026
Medium [CVE-2026-76304] In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file
Medium4.3
Oct 21, 2026
Medium [CVE-2026-76303] In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app
Medium5.7
Oct 21, 2026
Medium [CVE-2026-76297] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers
Medium4.2
Oct 21, 2026
Medium [CVE-2026-76296] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access
Medium4.3
Oct 21, 2026
Medium [CVE-2026-76295] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access
Medium4.3
Oct 21, 2026
Medium [CVE-2026-76294] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access
Medium4.3
Oct 21, 2026
Medium [CVE-2026-76292] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints
Medium6.5
Oct 21, 2026
Medium [CVE-2026-76289] In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files
Medium6.5
Oct 21, 2026
Medium [CVE-2026-76287] In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope
Medium5.4
Oct 7, 2026
Critical [CVE-2026-76285] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Critical9.8
Oct 7, 2026
Critical [CVE-2026-76268] In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands
Critical9.8
Oct 7, 2026
Critical [CVE-2025-22870 +43] Third-Party Package Updates in Splunk Add-on for Amazon Web Services - September 2026
Critical
Oct 7, 2026
Critical [CVE-2026-27141 +23] Third-Party Package Updates in Splunk Enterprise - September/October 2026
Critical
Oct 7, 2026
High [CVE-2026-76266] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges
High7.7
Oct 7, 2026
Medium [CVE-2026-76286] In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool
Medium5.3
Oct 7, 2026
Medium [CVE-2026-76280] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use
Medium6.3
Oct 7, 2026
Medium [CVE-2026-76279] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76278] In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76277] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period
Medium4.1
Oct 7, 2026
Medium [CVE-2026-76276] In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76275] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76274] In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token
Medium6.5
Oct 7, 2026
Medium [CVE-2026-76273] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76272] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76271] In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app
Medium6.5
Oct 7, 2026
Medium [CVE-2026-76270] In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other users
Medium6.5
Oct 7, 2026
Medium [CVE-2026-76269] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API
Medium6.5
Oct 7, 2026
Medium [CVE-2026-76267] In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API
Medium4.3
Oct 7, 2026
Medium [CVE-2026-76265] In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality
Medium6.5
Oct 7, 2026
Medium [CVE-2026-76264] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints
Medium4.3
Oct 7, 2026
Advisory [CVE-2026-76281] Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
Unrated

Get an email when Splunk publishes the next one.

See Splunk's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Splunk

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.