SPLUNK has released four advisories fixing 31 vulnerabilities across Splunk Enterprise and Splunk SOAR, with three flaws rated at CVSS 9.9. The company urges admins to apply the latest updates: Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16, and Splunk SOAR to 8.7.0 or newer. The overall tally spans 31 CVEs, with a mix of High, Medium and Unrated severities; no exploitation in the wild is publicly confirmed, and none of these CVEs appear in CISA’s Known Exploited Vulnerabilities catalog.
Notable details from the disclosures include CVE-2026-76291 (8.8) involving improper access control in scheduled search safeguards, CVE-2026-76298 (8.8) describing a hard-coded cryptographic key in the PostgreSQL sidecar service, and CVE-2026-76293 (7.2) enabling remote code execution via Splunk Web Manager XML. Additional DoS and related flaws appear across other CVEs such as CVE-2026-76288 and CVE-2026-76290 (both 7.5).
The Splunk hardening advisories also list two very high-severity issues in SOAR (up to CVSS 9.9) and four CVEs in the Enterprise hardening group, including CVE-2026-76531. Splunk notes these “internally identified” findings as priority reasons to patch promptly and to restrict access to Splunk Web and REST APIs to trusted networks. Affected versions for Enterprise cover 10.4.0–10.4.3, 10.2.0–10.2.7, 10.0.0–10.0.10 and 9.4.0–9.4.15; for SOAR, versions below 8.7.0 are affected.