MDR
Solutions
Partners
About
Resources
Affected Environment
Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Secure Gateway below 3.10.12, 3.9.26, and 3.8.73.
Threat Overview
Sixteen CVEs; CVE-2026-76299 and CVE-2026-76302 score CVSS 9.9, while externally reported CVE-2026-76298 scores 8.8.
Exposure Timeline
Advisories SVD-2026-1007 and SVD-2026-1008 issued 22 October 2026; fixed versions are available now.
Attack Surface
Splunk Web, REST API endpoints, scheduled searches, Manager XML, Secure Gateway, and the PostgreSQL sidecar on search head clusters.
Technical Root Cause
Hard-coded key derivation, missing authorisation, improper access control, unsafe expression evaluation, missing SPL safeguards, and unbounded resource use.
Exploitation Pathway
Low-privileged users abuse REST endpoints or capabilities to run OS commands; unauthenticated requests can crash Splunk Web.
Operational Impact
OS command execution as the Splunk service account, authorisation bypass, data read or deletion, and Splunk Web outages requiring restart.
Strategic Impact
A compromised SIEM weakens security monitoring; large and medium entities rated Critical, small entities High.
Required Mitigation
Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16; Edge Processor users must enable package download authentication.
Incident Response Guidance
Audit role capabilities, review search job logs and REST activity for abuse, and filter network access to management interfaces.
References
Splunk advisories SVD-2026-1007 and SVD-2026-1008.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)