Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

347 results · Feed

  • Medium 5.3
    CVE-2026-76340

    Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

    In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2026-76337

    Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the…

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2026-76338

    Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disr…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76336

    Improper Access Control through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Repre…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76335

    Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the sam…

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2026-76334

    SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user se…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76333

    Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored a…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76332

    SPL Injection through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-c…

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2026-76331

    SPL Injection through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76330

    SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-co…

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2026-76329

    SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attac…

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2026-76327

    SPL Injection through Splunk Web in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "sc_admin" Splunk roles into opening a crafted Spl…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.7
    CVE-2026-76328

    SPL Injection through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portab…

    Splunk Splunk Enterprise
  • Medium 5.7
    CVE-2026-76326

    Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline tabl…

    Splunk Splunk Enterprise
  • Medium 5.7
    CVE-2026-76324

    Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour …

    Splunk Splunk Enterprise
  • High 7.3
    CVE-2026-76325

    Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute…

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2026-76323

    SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language (SPL) safeguards for risky commands through the Job Details dashboard. The injected SP…

    Splunk Splunk Enterprise
  • Medium 6.7
    CVE-2026-76322

    SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacke…

    Splunk Splunk Enterprise
  • High 7.3
    CVE-2026-76321

    SPL Injection through Nearby Event Searches in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execut…

    Splunk Splunk Enterprise
  • Medium 5.9
    CVE-2026-76320

    SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language (SPL) searches on their behalf through the Event Type Builder. This could expose all …

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76319

    Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all releva…

    Splunk Splunk Enterprise
  • Medium 5.7
    CVE-2026-76318

    Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs …

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76316

    Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workf…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76317

    Path Traversal through the Lookup Configuration REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76314

    Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then …

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76315

    Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then acc…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76313

    Remote Code Execution (RCE) through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed s…

    Splunk Splunk Enterprise
  • Critical 9.4
    CVE-2026-76311

    Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data…

    Splunk Splunk Enterprise
  • Critical 9.4
    CVE-2026-76312

    Improper Access Control through Embedded Reports in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and a…

    Splunk Splunk Enterprise
  • Critical 9.4
    CVE-2026-76310

    Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data availa…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2026-76309

    Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing S…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2026-76262

    Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

    In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnera…

    Splunk Splunk Enterprise
  • Medium 5.4
    CVE-2026-76263

    Improper Access Control through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 (SPL2) modules belonging to other users through the data management orchestrator interface. T…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2026-76261

    Insecure Default Access Control List through the REST API in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2026-76260

    Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the rest_properties_get capability could read encrypted stored credentials through the Representational State Transfer (REST) API. Successful exploitation ca…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76259

    Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

    In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, a…

    Splunk Splunk Enterprise
  • Medium 6.5
    CVE-2026-76258

    Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splu…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.3
    CVE-2026-76256

    Information Exposure through REST API Endpoints in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language s…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2026-76257

    Missing Authorization through REST API Endpoints in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway adm…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • High 7.5
    CVE-2026-76254

    SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, whic…

    Splunk Splunk Enterprise