Splunk 21 October 2026 advisories: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 fix internally found flaws rated up to CVSS 9.9 and 12 further CVEs, including a PostgreSQL sidecar flaw that lets users without the admin or power roles run OS commands on search head cluster members (CVE-2026-76298, CVSS 8.8)

Splunk published security advisories on 21 October 2026, following an advance notice on 14 October, for Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 and Splunk SOAR 8.7.0. SVD-2026-1008 (Critical, highest CVSS 3.1 score 9.9) covers internally identified vulnerabilities in Splunk Enterprise 10.4.0 to 10.4.3, 10.2.0 to 10.2.7, 10.0.0 to 10.0.10 and 9.4.0 to 9.4.15, grouped by weakness class with one CVE per group: CVE-2026-76299 (improper access control, 9.9), CVE-2026-76300 (8.8), CVE-2026-76301 (7.6) and CVE-2026-76302 (improper neutralization, 9.9); each group's score is the highest among its findings, and Splunk gives no further detail. SVD-2026-1007 (High, highest 8.8) lists 12 CVEs. Splunk says that in CVE-2026-76298 (8.8) the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier, which appears in search job logs, so a user without the admin or power roles could derive the sidecar's superuser password and run operating-system commands as the Splunk Enterprise account on search head cluster members (versions below 10.4.4 and 10.2.8). CVE-2026-76291 (8.8) lets a user with the schedule_search capability bypass the SPL safeguards for risky commands, because the scheduler does not apply them to scheduled searches, and CVE-2026-76293 (7.2) lets a user with the edit_manager_xml capability run operating-system commands through Splunk Web Manager XML; the list also includes unauthenticated denial-of-service flaws in Splunk Web (CVE-2026-76288) and the Edge Processor package download endpoint (CVE-2026-76290), and two Splunk Secure Gateway issues (CVE-2026-76292, CVE-2026-76295). SVD-2026-1009 updates third-party packages in Splunk Enterprise. For Splunk SOAR, SVD-2026-1011 (Critical, highest 9.9) and SVD-2026-1010 (High) fix issues in versions below 8.7.0. Splunk's advisories do not report exploitation. This is a separate release from Splunk's 7 October advisories (Splunk Enterprise 10.4.3/10.2.7/10.0.10/9.4.15, CVE-2026-76268), which have their own card.

Product

Splunk Enterprise (including Splunk Secure Gateway), Splunk SOAR

Versions

Splunk Enterprise 10.4.0 to 10.4.3, 10.2.0 to 10.2.7, 10.0.0 to 10.0.10 and 9.4.0 to 9.4.15 (some CVEs affect fewer lines). Splunk Secure Gateway before 3.10.12, 3.9.26 and 3.8.73. Splunk SOAR below 8.7.0. As of 22 Oct.

CVSS

9.9 Critical (CVE-2026-76299 and CVE-2026-76302, CVSS 3.1, Splunk); 8.8 (CVE-2026-76298, CVE-2026-76291, CVE-2026-76300)

Exploited in Australia?

unknown

Patch to

Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 or later, Splunk Secure Gateway to 3.10.12, 3.9.26 or 3.8.73 (CVE-2026-76292, CVE-2026-76295) and Splunk SOAR to 8.7.0. If you cannot upgrade straight away, Splunk's workaround for CVE-2026-76298 is to turn off the PostgreSQL sidecar by adding [postgres] disabled = true to server.conf and restarting, but not on instances that use Edge Processor, OpAmp or SPL2 data pipelines, which it breaks. Some CVEs need extra steps after upgrading; see SVD-2026-1007.

Primary: Splunk — SVD-2026-1008: Security Hardening in Splunk Enterprise, October 2026 (21 Oct 2026) · Vendor: Splunk — SVD-2026-1007: Security Vulnerabilities in Splunk Enterprise, October 2026 (21 Oct 2026) · CVE: CVE-2026-76298, CVE-2026-76299, CVE-2026-76300, CVE-2026-76301, CVE-2026-76302, CVE-2026-76291, CVE-2026-76293, CVE-2026-76288, CVE-2026-76290, CVE-2026-76292, CVE-2026-76295, CVE-2026-76268 · Splunk — SVD-2026-1011: Security Hardening in Splunk SOAR, October 2026 (21 Oct 2026) · Splunk — SVD-2026-1009: Third-Party Package Updates in Splunk Enterprise - October 2026 (21 Oct 2026) · Splunk — SVD-2026-1010: Security Vulnerabilities in Splunk SOAR - October 2026 (21 Oct 2026)

vulnerabilities