MDR
Solutions
Partners
About
Resources
Affected Environment
Splunk Enterprise 10.4.0 to 10.4.2, 10.2.0 to 10.2.6, 10.0.0 to 10.0.9, 9.4.0 to 9.4.14, and Secure Gateway.
Threat Overview
Seventeen vulnerabilities enable remote code execution, privilege escalation, authorization bypass, SQL injection, SSRF, denial of service, and information disclosure.
Exposure Timeline
Disclosed in Splunk’s September/October 2026 Security Hardening Release. Fixed versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 available.
Attack Surface
Patroni REST API on search head cluster members, Splunk REST API endpoints, Secure Gateway, SPL2 modules, and Observability Cloud apps.
Technical Root Cause
Missing authentication on Patroni REST API, plus missing authorization checks, unparameterized SQL, weak input validation, and unvalidated outbound requests.
Exploitation Pathway
Unauthenticated attackers reach the Patroni REST API to run OS commands; low-privileged users abuse REST endpoints for access.
Operational Impact
Remote OS command execution, privilege escalation, search job and query data exposure, Observability token disclosure, and service disruption.
Strategic Impact
Critical for large and medium government and business entities, high for small ones. Splunk compromise undermines security monitoring visibility.
Required Mitigation
Upgrade Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10, or 9.4.15 after testing. Filter network traffic to REST interfaces.
Incident Response Guidance
Review Patroni and REST API activity, audit role capabilities, and rotate exposed Observability Cloud API tokens.
References
Splunk Security Advisory SVD-2026-1001; CVE-2026-76264 to CVE-2026-76280.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)