Splunk patches 24 flaws, four critical, in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
62
CVE-2026-76288
Unauthenticated DoS in Splunk Web JavaScript logger
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Splunk Web does not limit request-header parsing before handling requests to its JavaScript logger endpoint. An unauthenticated remote attacker can send one crafted request and make Splunk Web stop responding until Splunk Enterprise is restarted. Confidentiality and integrity are not affected. Splunk Enterprise builds below the fixed releases are affected.
What to do: Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16. If Splunk Web stops responding, restart Splunk Enterprise to restore it.
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 | 10.4.4, 10.2.8, 10.0.11, and 9.4.16 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.