Splunk has shipped its August security release for Splunk Enterprise, and the three worst bugs in it turn a convenience feature into a way into somebody else's session. If your organization embeds a Splunk report in a wiki page, a status board or an intranet dashboard, an unauthenticated visitor could pull down the underlying search job's archive, lift the session material stored inside it, and then do whatever the person who owned that report could do. Where that owner holds the admin role, Splunk says that extends to administrative actions.
All three carry a CVSS score of 9.4. They are the only critical entries in a batch of 60.
The embed token was never meant to be a login
Embedded reports exist so a chart can appear on a page without the viewer needing a Splunk account, using a token carried in the embed. In the affected releases the authorization check around that token did not cover one path: the REST API request that downloads a search job's dispatch archive. CVE-2026-76310 and CVE-2026-76311 let a user holding an embed token fetch that archive and recover session material from it. CVE-2026-76312 is the broadest of the three, because Splunk says being able to read the HTML source of a page that embeds a report is enough: the archived search job data carried sensitive session material, and the download path did not enforce the embedded-report authorization boundary.
Two of the sixty are not finished by upgrading
Splunk flags two CVEs that need a configuration change on top of the new version, which is the detail most likely to be missed by anyone who patches and moves on. CVE-2026-76338 (8.1) is an authentication flaw in distributed search: the token endpoint does not require a signed request to identify a configured search peer, so it falls back to shared local key material, and an unauthenticated party holding a trusted distributed search private key could forge an administrative session token. The extra step is to set strictPeerNameValidation = true in authentication.conf on every distributed node, then restart. CVE-2026-76352 (8.8) lets a user who holds neither the admin nor the power role create or edit a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the account Splunk itself runs under. After upgrading, set scripted_lookup_raw_write_enforcement = block in limits.conf.
One bug only version 10.4 has
The rest of the batch is mostly SPL injection, remote code execution through the REST API and through Splunk Web manager configuration (several rated 8.8), path traversal, stored cross-site scripting and safeguard bypasses. Worth separating out is CVE-2026-76355 (7.5), an unauthenticated information disclosure in an Edge Processor service endpoint that exposes pipeline configurations. It affects only Splunk Enterprise 10.4, only when Edge Processor is turned on, and the workaround is to set edge_processor_enabled = false in server.conf. Sixty CVEs in one release is a large number, though not this month's largest: Oracle's quarterly update carried 943 fixes.
Upgrade to 10.4.2, 10.2.6, 10.0.9 or 9.4.14
The affected branches are 10.4.0 to 10.4.1, 10.2.0 to 10.2.5, 10.0.0 to 10.0.8, and 9.4.0 to 9.4.13. The fixed builds are 10.4.2, 10.2.6, 10.0.9 and 9.4.14 respectively, and the two configuration steps above still apply afterwards. Splunk published the details in advisory SVD-2026-0801 on 19 August, and HKCERT relayed it to Hong Kong defenders in a security bulletin the following day. Neither document reports exploitation.
A monitoring platform is an unusually attractive target for the simple reason that it already holds what the rest of the estate sends it. That was the argument in June, when a pre-authentication flaw let attackers take over Splunk servers without a login, and it is the argument for treating an embedded chart on an intranet page as part of the security boundary rather than as a widget.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.