Splunk Enterprise (Product): news timeline & CVEs

Splunk security advisory (AV26-1018)

Canada's Cyber Centre urges patches for vulnerabilities in Splunk Enterprise and Splunk MCP Server.

On October 8, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1018 on Splunk vulnerabilities known as of October 7. Affected Splunk Enterprise versions are those before 10.0.10, 10.2.7, 10.4.3, and 9.4.15, and Splunk MCP Server before 1.2.1. The centre points administrators to Splunk notices SVD-2026-1001 and SVD-2026-1004 and recommends applying available updates. The advisory does not report active exploitation.

Canadian Centre for Cyber SecurityOct 8, 13:41 UTC · 11h agoAdvisory 3 sources

SonicWall and Splunk Patch Critical Vulnerabilities

SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000, and Splunk fixed critical command-execution flaws.

SonicWall patched four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10 pre-authenticated SSRF that could let remote attackers reach internal functionality. The updates also cover remote code execution and XSS issues; SonicWall said there is no evidence of exploitation and that firewall SSL-VPN is unaffected. Splunk fixed dozens of bugs in Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services, including three critical Enterprise flaws enabling command execution, unauthorized access, and code injection.

SecurityWeekOct 8, 12:37 UTC · 12h agoVulnerability 6 sources CVE-2026-1022551

Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

Splunk patched CVE-2026-76268, a CVSS 9.8 flaw letting unauthenticated attackers run OS commands via the Patroni API.

Splunk advisory SVD-2026-1001, published October 7, 2026, covers CVE-2026-76268, a CVSS 9.8 missing-authentication flaw (CWE-306) in the Patroni REST API on a search head cluster member. A remote unauthenticated attacker can run operating-system commands without user interaction. Affected releases are Splunk Enterprise 10.4 before 10.4.3 and 10.2 before 10.2.7; branches 10.0.x and 9.4.x are not affected, and Splunk reports no active exploitation. Fixes are in 10.4.3 and 10.2.7; some deployments can set disabled = true under the [postgres] stanza and restart.

GBHackersupdated Oct 8, 13:41 UTC · 11h agofirst Oct 8, 09:07 UTC · 16h agoVulnerability 3 sources CVE-2026-762681

Splunk Patches Critical 9.8 Flaw Allowing Unauthenticated Remote Command Execution

Splunk patched CVE-2026-76268, a CVSS 9.8 flaw allowing unauthenticated command execution via Patroni.

Splunk patched CVE-2026-76268, disclosed October 7, 2026, a CWE-306 missing-authentication flaw in the Patroni REST API on Splunk Enterprise search head cluster members. Scored CVSS 9.8, it could allow a network attacker to run operating-system commands without credentials or user interaction. Versions before 10.4.3 in the 10.4 branch and before 10.2.7 in the 10.2 branch are affected; 10.0.x and 9.4.x are not affected by this CVE. Splunk credits Gabriel Nitu, reports no evidence of exploitation, and separately published SVD-2026-1002, whose CVE-2026-76281 also scores 9.8.

Cyber Security Newsupdated Oct 8, 13:41 UTC · 11h agofirst Oct 8, 07:04 UTC · 18h agoVulnerability 3 sources CVE-2026-76268 CVE-2026-762811

Splunk Enterprise

Timeline4 articles

Related CVEsby mentions

Appears with

Splunk security advisory (AV26-1018)

SonicWall and Splunk Patch Critical Vulnerabilities

Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

Splunk Patches Critical 9.8 Flaw Allowing Unauthenticated Remote Command Execution