Splunk has released security updates addressing three critical vulnerabilities rated CVSS 9.9, alongside two remote code execution (RCE) flaws affecting Splunk Enterprise.
Published Oct. 21, the advisories cover two critical flaws in Splunk Enterprise and one in Splunk SOAR. Splunk has not confirmed whether the three critical vulnerabilities allow unauthenticated RCE, but its separate Enterprise advisory documents two command-execution issues that require existing user privileges.
Administrators can address the newly disclosed vulnerabilities by upgrading Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, or 9.4.16, depending on the branch, and Splunk SOAR to 8.7.0.
Three critical Splunk vulnerabilities rated 9.9
Splunk's Enterprise security-hardening advisory identifies four vulnerabilities, including two rated CVSS 9.9:
- CVE-2026-76299 (9.9): Improper access control, classified as CWE-284.
- CVE-2026-76302 (9.9): Improper neutralization, classified as CWE-707.
- CVE-2026-76300 (8.8): Improper control of a resource through its lifetime.
- CVE-2026-76301 (7.6): Protection mechanism failure.
Splunk groups multiple internally identified findings by Common Weakness Enumeration (CWE), assigning one CVE to each group. The published CVSS score represents the highest-rated finding within that group.
The company has not disclosed detailed exploitation conditions or CVSS vectors for the two 9.9 Enterprise vulnerabilities. Their authentication requirements and potential for RCE therefore remain unconfirmed.
A separate SOAR advisory identifies CVE-2026-76531, another 9.9 vulnerability involving files or directories accessible to external parties.
Splunk has not identified that SOAR flaw as unauthenticated RCE either.
The disclosure follows earlier Splunk privilege-escalation vulnerabilities that exposed weaknesses in how the platform protects sensitive components.
Two confirmed RCE flaws require authentication
Splunk's October 21 Enterprise vulnerability advisory separately describes two flaws that can allow attackers to execute operating-system commands.
CVE-2026-76293 (CVSS 7.2) affects Splunk Web Manager XML. A user with the edit_manager_xml capability could execute commands using the permissions of the account running Splunk Enterprise.
The vulnerability requires high privileges and affects Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16.
CVE-2026-76298 (CVSS 8.8) involves a hard-coded cryptographic key in the PostgreSQL sidecar service.
A user without the admin or power role could derive the database superuser password and execute operating-system commands on search head cluster members.
This flaw requires low privileges and affects Enterprise versions below 10.4.4 and 10.2.8.
Neither vulnerability is classified as unauthenticated RCE.
The same advisory identifies two unauthenticated denial-of-service vulnerabilities, CVE-2026-76288 and CVE-2026-76290, each rated CVSS 7.5.
These findings demonstrate that the October 21 release contains several distinct security risks, rather than one critical RCE exploit.
A separate unauthenticated RCE was disclosed October 7
Splunk previously confirmed an unauthenticated RCE vulnerability, CVE-2026-76268, in its October 7 advisory.
The flaw affects the Patroni REST API on Splunk Enterprise search head cluster members. An unauthenticated attacker with network access to the interface could execute operating-system commands.
Rated CVSS 9.8, the vulnerability affects Enterprise versions below 10.4.3 and 10.2.7. The 10.0.x and 9.4.x branches are not affected.
This is a separate disclosure from the October 21 vulnerabilities and should not be confused with the newer 9.9 findings.
Organizations managing multiple Splunk deployments should review both releases, particularly where older search head cluster members remain accessible.
Affected versions and patch guidance
Splunk recommends upgrading affected products to the following versions or later:
| Product | Affected versions | Fixed version |
|---|---|---|
| Splunk Enterprise 10.4 | 10.4.0–10.4.3 | 10.4.4 |
| Splunk Enterprise 10.2 | 10.2.0–10.2.7 | 10.2.8 |
| Splunk Enterprise 10.0 | 10.0.0–10.0.10 | 10.0.11 |
| Splunk Enterprise 9.4 | 9.4.0–9.4.15 | 9.4.16 |
| Splunk SOAR | Below 8.7.0 | 8.7.0 |
Individual vulnerabilities may affect narrower version ranges.
The October 21 releases also include third-party package updates, allowing administrators to address native vulnerabilities and affected dependencies through the same Enterprise upgrades.
Security teams should prioritize the following actions:
- Inventory Splunk Enterprise and SOAR installations, including search head cluster members.
- Upgrade affected installations to the appropriate fixed versions.
- Review privileged capabilities, particularly
edit_manager_xml, and restrict unnecessary access. - Check whether the PostgreSQL sidecar service is enabled on affected systems.
- Review the additional remediation requirements for Splunk Secure Gateway and Edge Processor components.
For CVE-2026-76298, Splunk provides an interim workaround: disable the PostgreSQL sidecar through the [postgres] stanza in server.conf and restart Splunk Enterprise.
However, this workaround must not be applied to instances using Edge Processor, OpAmp, or SPL2 data pipelines because it breaks those features.
Organizations should also review their broader patch management processes to identify deployments that remain on vulnerable releases.
The October 21 fixes are available now. Administrators do not need to wait for additional exploitation details before upgrading.
What remains unresolved is whether Splunk will publish further technical information about the three CVSS 9.9 vulnerabilities. Until then, their precise attack conditions should not be described as confirmed unauthenticated RCE.
Also read: Recent NGINX security patches address five vulnerabilities, including three rated critical.