Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-76531

    Files or Directories Accessible to External Parties in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.8
    CVE-2026-76529

    Improper Protection of Alternate Path in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.8
    CVE-2026-76528

    Protection Mechanism Failure in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.8
    CVE-2026-76527

    Improper Check or Handling of Exceptional Conditions in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.8
    CVE-2026-76408

    Improper Control of a Resource Through its Lifetime in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.8
    CVE-2026-76407

    Improper Access Control in Splunk SOAR

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk SOAR
  • Critical 9.9
    CVE-2026-76302

    Security Hardening in Splunk Enterprise - October 2026

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk Enterprise
  • Critical 9.8
    CVE-2026-76301

    Security Hardening in Splunk Enterprise - October 2026

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk Enterprise
  • Critical 9.9
    CVE-2026-76299

    Security Hardening in Splunk Enterprise - October 2026

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk Enterprise
  • Critical 9.8
    CVE-2026-76285

    Improper Adherence to Coding Standards in Splunk Enterprise

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk Enterprise
  • Critical 9.8
    CVE-2026-76284

    Improper Neutralization in Splunk Enterprise

    As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …

    Splunk Splunk Enterprise
  • Critical 9.8
    CVE-2026-76268 Public exploit

    Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled …

    Splunk Splunk Enterprise
  • Critical 9.1
    CVE-2026-76404

    Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

    In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management c…

    Splunk Splunk MCP Server app
  • Critical 9.4
    CVE-2026-76311

    Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data…

    Splunk Splunk Enterprise
  • Critical 9.4
    CVE-2026-76312

    Improper Access Control through Embedded Reports in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and a…

    Splunk Splunk Enterprise
  • Critical 9.4
    CVE-2026-76310

    Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data availa…

    Splunk Splunk Enterprise
  • Critical 9.1
    CVE-2026-20266

    OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

    In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool…

    Splunk Splunk AI Toolkit
  • Critical 9.8
    CVE-2026-20253 Exploited Public exploit EPSS 97%

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpo…

    Splunk Splunk Enterprise
    KEV Jun 18, 2026
  • Critical 9.0
    CVE-2022-32158

    Splunk Enterprise deployment servers allow client publishing of forwarder bundles

    Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulner…

    Splunk Splunk Enterprise