Splunk
Splunk Enterprise: vulnerabilities and CVEs
Splunk Enterprise has 13 published vulnerabilities, 13 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs13
Last 12 months13
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-76280 | Medium (6.3) | 0.17% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk… |
| CVE-2026-76279 | Medium (4.3) | 0.17% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to… |
| CVE-2026-76278 | Medium (4.3) | 0.16% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access… |
| CVE-2026-76277 | Medium (4.1) | 0.18% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is… |
| CVE-2026-76275 | Medium (4.3) | 0.20% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users,… |
| CVE-2026-76273 | Medium (4.3) | 0.17% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled… |
| CVE-2026-76272 | Medium (4.3) | 0.17% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The… |
| CVE-2026-76271 | Medium (6.5) | 0.27% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer… |
| CVE-2026-76270 | Medium (6.5) | 0.24% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected… |
| CVE-2026-76269 | Medium (6.5) | 0.22% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job… |
| CVE-2026-76268 | Critical (9.8) | 0.40% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster… |
| CVE-2026-76266 | High (7.7) | 0.12% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run… |
| CVE-2026-76264 | Medium (4.3) | 0.17% | — | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints.… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.