# Splunk Addresses 24 Security Vulnerabilities, Including Critical Risks

*Published October 26, 2026*
*Source: [https://cybersecuritynews.com/splunk-fixes-24-security-flaws/](https://cybersecuritynews.com/splunk-fixes-24-security-flaws/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/splunk-addresses-24-security-vulnerabilities-including-critical-risks) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Splunk has issued security updates to address 24 vulnerabilities in its Enterprise and SOAR products. Among these, four critical flaws were identified, with CVSS scores ranging from 9.3 to 9.9, highlighting significant risks. The updates were released on October 21, 2026, through three security advisories that cover a range of issues including access control, input handling, and remote code execution.

The advisories for Splunk Enterprise highlight several critical vulnerabilities, with CVE-2026-76299 and CVE-2026-76302 both receiving a critical score of 9.9. These pertain to improper access control and improper neutralization. Another notable vulnerability, CVE-2026-76300, scored 8.8 and involves inadequate control of a resource during its lifecycle. Meanwhile, CVE-2026-76301, with a score of 7.6, is due to a protection failure. Often, these CVEs represent clusters of related issues grouped by weakness type.

For Splunk SOAR, eight vulnerabilities were addressed in version 8.7.0. The most severe, CVE-2026-76531, also carries a 9.9 score and may result in unauthorized access to files or directories. Other significant flaws such as CVE-2026-76407, scored at 9.3, involve improper access control. Additional vulnerabilities include unsafe URL path checks and weak resource controls.

A separate advisory for Splunk Enterprise details 12 more vulnerabilities. Among these, CVE-2026-76291 and CVE-2026-76298, both scored at 8.8, pose risks of bypassing safeguards and deriving sensitive credentials. Another vulnerability, CVE-2026-76293, presents a remote code execution threat. Furthermore, two denial-of-service vulnerabilities, CVE-2026-76288 and CVE-2026-76290, could disrupt services without requiring user authentication.

Given Splunk's central role in security monitoring, these vulnerabilities could lead to exposure of logs, weakened detection capabilities, and disrupted investigations. Organizations should promptly review their systems and update to the latest versions: Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16, and Splunk SOAR to 8.7.0. For specific vulnerabilities, updates to Splunk Secure Gateway are also necessary. Administrators should carefully assess dependencies before disabling features to mitigate risks.