Splunk Splunk Enterprise Vulnerabilities & Security Advisories
185 advisories tracked · Splunk (prodsec@splunk.com CNA) via NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Splunk advisory that VulniPulse classified as Splunk Enterprise, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 5 critical, 81 high, 90 medium, 4 low.
Android app · Google Play
Monitor Splunk CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Splunk (prodsec@splunk.com CNA) via NVD
Splunk is its own CVE Numbering Authority. VulniPulse ingests Splunk's CVEs from the NVD CNA feed (prodsec@splunk.com), each linking to its SVD-YYYY-NNNN advisory on advisory.splunk.com. Covers Splunk Enterprise, Splunk Cloud Platform, the Universal Forwarder, IT Service Intelligence (ITSI), SOAR, Enterprise Security and Splunk apps/add-ons — the SIEM at the centre of most SOCs, so a security-team audience that patches on advisory day.
Latest Splunk Splunk Enterprise advisories
Critical [CVE-2026-76268] Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings ( ) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.
Critical [CVE-2026-76312] Improper Access Control through Embedded Reports in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. For more information see Additional configuration for embedded reports ( ) and Embed scheduled reports ( ) in the Splunk documentation.
Critical [CVE-2026-76311] Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester. For more information see Additional configuration for embedded reports ( ) and Embed scheduled reports ( ) in the Splunk documentation.
Critical [CVE-2026-76310] Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests. For more information see Additional configuration for embedded reports ( ) and About configuring role-based user access ( ) in the Splunk documentation.
Critical [CVE-2022-32158] Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.