CVE-2026-76360

Splunk SOAR versions below 8.6.0 are affected by a missing authorization check on the /rest/health endpoint, allowing authenticated users with no role to retrieve restricted system and cluster telemetry; CVSS 4.3 MEDIUM, remediation is to upgrade to version 8.6.0. Exploitation details are not pro...

CVE-2026-76357

In Splunk SOAR on-premises versions below 8.6.0, the REST API fails to enforce role requirements and does not confine user-supplied file paths to the temporary directory, enabling an authenticated, role-less user to submit crafted paths and achieve arbitrary code execution (CVSS 7.6, HIGH). No in...

CVE-2026-76357 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

CVE-2026-76354

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by a path traversal vulnerability in the Search Head Clustering bundle replication mechanism. The root cause is that the system does not validate replicated bundle file names or neutralize NUL bytes before constructi...

CVE-2026-76354 Path Traversal through Search Head Clustering in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-76355 Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prio...

CVE-2026-76355

Splunk Enterprise 10.4 versions below 10.4.2 are affected by CVE-2026-76355: the Edge Processor REST API endpoint lacks authentication controls, allowing unauthenticated users to retrieve Edge Processor pipeline configuration data. CVSS 7.5 (HIGH). No exploitation details are provided. Affected d...

CVE-2026-76352 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76352

CVE-2026-76352 is an improper authorization vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. An...

CVE-2026-76352 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76351

CVE-2026-76351 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) and Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14). The root cause is that Secure Gateway does not validate decoded report notification identifiers before constru...

CVE-2026-76351 Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76351 Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76347 Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery SSRF in report notifications to send system-authenticated...

CVE-2026-76345 Remote Code Execution (RCE) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

CVE-2026-76345

CVE-2026-76345 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2 (also affecting 10.2.x, 10.0.x, and 9.4.x branches). The search head cluster member bundle REST API fails to enforce its expected authorization boundary and does not validate bundle paths before acc...

CVE-2026-76344 Path Traversal through the Search Dispatch REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76344 Path Traversal through the Search Dispatch REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76344

Splunk Enterprise fails to validate search identifiers supplied to the Search Dispatch REST API, letting any non-admin user write dispatch metadata to arbitrary host paths. CVSS 3.1 base score 7.7 (HIGH), network attack vector, low privileges required. Affected branches: 9.4.x, 10.0.x, 10.2.x, 10...

CVE-2026-76343 Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-chosen Structured Query Language SQL queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stor...