PT-2026-78817

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description An unauthenticated user can access the add-on OpenAPI specification via Splunk Web static file paths. This exposure occurs because the generated OpenAPI...

PT-2026-78737

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user possessing an embedded report token...

PT-2026-78728

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

PT-2026-78797

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user with restricted tenant access can use the Representational State Transfer REST API to view the names and identifiers of tenants that are outside their assigned role scope...

PT-2026-78825

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76344: Path Traversal: 'dir/../../filename'

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76351: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76394: Missing Authorization

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...

PT-2026-78772

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description A user with a high-privilege role capable of managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations accessible by the...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...

CVE-2026-76357: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

PT-2026-78723

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Description A user without admin or power roles can force the Splunk App for Splunk Observability Cloud to forward...

PT-2026-78821

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description Low-privileged users without admin or power roles can start, stop, and configure containers, as well as read or modify connection and configuration data. This occurs because multiple handle...

CVE-2026-76390: Exposure of Sensitive Information to an Unauthorized Actor

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76400: Uncontrolled Resource Consumption

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API and influence responses from a Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry faile...

PT-2026-78763

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.2 through 10.2.5 Splunk Enterprise versions 10.4.0 through 10.4.1 Description An issue exists where the SPL2 module management Representational State Transfer REST API does not sufficiently authorize and validate...

CVE-2026-76355: Missing Authentication for Critical Function

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prio...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

CVE-2026-76402: Server-Side Request Forgery (SSRF)

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure a non-secure Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise that causes the connector to send...

PT-2026-78767

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can trigger the reloading of token-signing keys via the Representational State Transfer REST API. This occurs because the REST API fails to require authenticati...