Splunk patches 24 flaws, four critical, in Enterprise and SOAR
Original title: Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
Splunk published fixes on October 21 for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical issues scored 9.3 to 9.9. Enterprise bugs include improper access control and a path for a low-privileged user to obtain a PostgreSQL sidecar password and run commands. SOAR 8.7.0 fixes file exposure and access-control flaws. The advisory does not describe exploitation.
- CVE-2026-76299 and CVE-2026-76302 in Enterprise are scored 9.9.
- CVE-2026-76531 in SOAR is scored 9.9; CVE-2026-76407 is scored 9.3.
- Unauthenticated denial-of-service bugs are CVE-2026-76288 and CVE-2026-76290.
- Unused Web, Pipeline Builders, Secure Gateway, or PostgreSQL sidecar features can be disabled.
Impact: Command execution, exposed files, or unauthenticated denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | — | 10.4.4, 10.2.8, 10.0.11, or 9.4.16 |
| Splunk SOAR | — | 8.7.0 or later |
| Splunk Secure Gateway | — | 3.10.12, 3.9.26, or 3.8.73 |
- 1.Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16.
- 2.Upgrade Splunk SOAR to 8.7.0 or later.
- 3.Update Secure Gateway to 3.10.12, 3.9.26, or 3.8.73 for CVE-2026-76292 and CVE-2026-76295.
- CVEs
- CVE-2026-76299CVE-2026-76302CVE-2026-76300CVE-2026-76301CVE-2026-76531CVE-2026-76407CVE-2026-76291CVE-2026-76298CVE-2026-76408CVE-2026-76526CVE-2026-76530CVE-2026-76288CVE-2026-76290CVE-2026-76529CVE-2026-76293CVE-2026-76289CVE-2026-76292CVE-2026-76528CVE-2026-76527CVE-2026-76287CVE-2026-76294CVE-2026-76295CVE-2026-76296CVE-2026-76297
- Vendors
- Splunk
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76291 | Risky SPL safeguard bypass in Splunk Enterprise scheduled searches | 8.8 group max | — | ||
| CVE-2026-76299 | Improper access control in unnamed Cisco software | 9.9 | — | ||
| CVE-2026-76301 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review | 9.8 group max | — | ||
| CVE-2026-76302 | Improper neutralization in Cisco software (low-privilege network) | 9.9 | — | ||
| CVE-2026-76530 | Non-canonical URL authorization flaw in Cisco software | 8.8 | — | ||
| CVE-2026-76531 | External file access in Cisco software (low privileges) | 9.9 | — |
From the original article
3 min read at cybersecuritynews.com
Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9. 3 to 9. 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.