Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR

What happened?

Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9.3 to 9.9. Splunk published the fixes on October 21, 2026, across three advisories covering access control, input handling, exposed files, remote code execution, denial of service, and weak authorization checks. The Splunk Enterprise security hardening advisory covers four CVEs found internally. CVE-2026-76299 and CVE-2026-76302 both have a 9.9 score and involve improper access control and improper neutralization.

Key details

• Splunk released updates for 24 vulnerabilities across Enterprise and SOAR on October 21, 2026.
• Splunk SOAR version 8.7.0 fixes eight CVEs, including CVE-2026-76531 rated 9.9 which may leave files or directories open to outside parties.
• Two unauthenticated denial-of-service bugs CVE-2026-76288 and CVE-2026-76290 could stop Splunk services responding via crafted web requests or repeated package downloads.
• CVE-2026-76291 could let a user with scheduled-search rights bypass safeguards and run risky SPL commands.
• CVE-2026-76298 could allow a low-privileged user to derive the PostgreSQL sidecar superuser password and run operating system commands on search head cluster members.
• CVE-2026-76293 allows a user with edit_manager_xml capability to run operating system commands through Splunk Web Manager XML.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.