Splunk has fixed 16 vulnerabilities in Splunk Enterprise, the most serious of which lets a user who holds neither the admin nor the power role derive a database superuser password and run operating system commands on the server. The fixes ship in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16, published on October 21 across two advisories, SVD-2026-1007 and SVD-2026-1008. Hong Kong's HKCERT has also flagged the release. We covered Splunk's previous critical fix in Critical Splunk flaw lets attackers run commands, no login.
A database password derived from a visible ID
CVE-2026-76298 (CVSS 8.8) affects Splunk Enterprise below 10.4.4 and 10.2.8. Splunk says a low-privileged user could derive the superuser password for the PostgreSQL sidecar database and run arbitrary operating system commands, as the account running Splunk, on search head cluster members. The cause, according to Splunk, is that the sidecar derives a privileged database password from the search head cluster identifier, and that identifier appears in search job logs. Splunk credits Ofir Alkoby of a.security.
CVE-2026-76291 (CVSS 8.8) lets a user with the schedule_search capability bypass the safeguards Splunk applies to risky Search Processing Language (SPL) commands, because the scheduler does not apply those safeguards to scheduled searches. Splunk says that could disclose or alter data or disrupt availability, and it lists no workaround. CVE-2026-76293 (CVSS 7.2) allows a user holding the edit_manager_xml capability to execute operating system commands by opening an affected configuration in the Splunk Web Manager page, because Splunk Web evaluates user-controlled expressions from Manager XML without sufficient restriction.
Two crash bugs need no login
Two high-severity denial-of-service bugs require no authentication. CVE-2026-76288 (CVSS 7.5) lets a single crafted request to the Splunk Web JavaScript logger endpoint stop Splunk Web responding until Splunk is restarted. CVE-2026-76290 (CVSS 7.5) lets repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app exhaust system resources; Splunk does not list the 9.4 branch as affected by it. The remaining SVD-2026-1007 items, rated 4.2 to 6.5, cover a low-privilege denial of service through the REST API, authorization gaps in several REST endpoints and in Splunk Secure Gateway, an SPL injection in Splunk Secure Gateway, and a cross-site request forgery issue.
Four internal findings scored up to 9.9
The second advisory, SVD-2026-1008, groups vulnerabilities Splunk found internally under four CVEs, one per weakness class, each carrying the highest score among its findings. Two score 9.9: CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization). CVE-2026-76300 scores 8.8 and CVE-2026-76301 scores 7.6. Splunk publishes no further detail on these findings.
Upgrade to 10.4.4, 10.2.8, 10.0.11 or 9.4.16
Upgrade Splunk Enterprise to one of the fixed versions. Some issues need extra steps. CVE-2026-76292 and CVE-2026-76295 also require upgrading Splunk Secure Gateway to 3.10.12, 3.9.26 or 3.8.73. For CVE-2026-76290, Splunk says to prepare existing Edge Processor instances, turn on authentication for Edge Processor package downloads and restart after upgrading. If you cannot patch CVE-2026-76298 right away, Splunk's workaround is to disable the PostgreSQL sidecar by setting disabled = true under a [postgres] stanza in server.conf and restarting, but not on instances that use Edge Processor, OpAmp or SPL2 data pipelines, which the change would break.
The highest scores in this release belong to the findings Splunk has chosen not to describe, which leaves upgrading as the only lever defenders have on them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.