This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk fixes 83 vulnerabilities in its products

Splunk fixes more than 83 vulnerabilities in Splunk Enterprise, Splunk MCP Server and Splunk Add-on for Amazon Web Services. A large part of them concern third-party components. For four medium-severity vulnerabilities, CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280, the update alone is not enough; additional steps are required, which Splunk describes at [1]. The most severe vulnerabilities are described below; you can find the rest at [1][2][3][4][5]. Individual products and their fixed versions: Splunk Enterprise – 10.4.3, 10.2.7, 10.0.10, 9.4.15 [1][2][3] Splunk MCP Server – 1.2.1 [4] Splunk Add-on for Amazon Web Services – 8.2.2 [5]

Splunk Enterprise - RCE (CVE-2026-76268)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute arbitrary operating system commands due to missing authentication for critical configuration operations of the Patroni REST API in Splunk Enterprise [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.4.0, <10.4.3; >=10.2.0, <10.2.7

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 10. 2026.

Splunk Enterprise - privilege escalation (CVE-2026-76266)
CVSS 7.7 (High)

An authenticated local attacker with high privileges can gain elevated privileges when updating the Linux package of Splunk Enterprise [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.4.0, <10.4.3; >=10.2.0, <10.2.7; >=10.0.0, <10.0.10; >=9.4.0, <9.4.15

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 10. 2026.

Splunk Enterprise - SQL injection (CVE-2026-76270)
CVSS 6.5 (Medium)

An authenticated remote attacker with low privileges can carry out an SQL injection attack due to insufficient input sanitization in the SPL2 module catalog of Splunk Enterprise [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.4.0, <10.4.3; >=10.2.0, <10.2.7; >=10.0.0, <10.0.10; >=9.4.0, <9.4.15

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2026-76270 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 10. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 8. 10. 2026.

CESNET, z.s.p.o. Logo