EUVD-2026-107654

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the editfederatedproviders capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches fr...

CVE-2026-76297

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the editfederatedproviders capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches fr...

CVE-2026-76297

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to a Cross-Site Request Forgery (CSRF) in Splunk Web. An unauthenticated attacker could trick a user with the edit_federated_providers capability into turning off all federated search providers. The root cause is ...

CVE-2026-76297 Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the editfederatedproviders capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches fr...

EUVD-2026-63126

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-76319

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-76319 Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-76319

Splunk Enterprise federated search dispatch flow accepts caller-controlled bundle selection without enforcing the fsh_manage capability, enabling a low-privileged user to achieve remote code execution. CVSS 8.8 (High). Affected versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14 ; upgrade to one of the...

CVE-2026-76319 Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

PT-2026-78746

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without the fsh manage capability can...

CVE-2026-76319: Missing Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-71467

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

EUVD-2026-56897

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

CVE-2026-71467

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

CVE-2026-71467

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

PT-2026-70867

Name of the Vulnerable Software and Affected Versions search-v2-api affected versions not specified Description An authentication bypass exists in the authentication middleware of the affected component. The system unconditionally skips authentication checks when a request contains an Upgrade:...

Encrypted Federated Search Using Homomorphic Encryption

The sharing of information between agencies is effective in dealing with cross-jurisdictional criminal activities; however, such sharing is often restricted due to concerns about data privacy, ownership, and compliance. Towards this end, this work has introduced a privacy-preserving federated...

DEA Investigating Breach of Law Enforcement Data Portal

The U.S. Drug Enforcement Administration DEA says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment...

HPE Fixes Critical Zero-Day in SIM

Hewlett Packard Enterprise HPE has fixed a critical zero-day remote code execution RCE flaw in its HPE Systems Insight Manager SIM software for Windows that it originally disclosed in December. HPE SIM is a tool that enables remote support automation and management for a variety of HPE servers,...