234 matches found
Vulnerabilities fixed in Splunk Enterprise
Splunk has addressed multiple vulnerabilities in Splunk Enterprise. Various vulnerabilities exist in Splunk Enterprise versions prior to 10.4.4 and a few other specific versions. These include: - Improper validation in the Data Management REST API, allowing users with certain roles to create or...
EUVD-2026-107655
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is...
EUVD-2026-107663
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
EUVD-2026-107658
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...
CVE-2026-76293
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...
CVE-2026-76296
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is...
CVE-2026-76288
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
CVE-2026-76296 Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is...
CVE-2026-76296
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 , a missing authorization vulnerability allows users without admin or power roles to create, move, edit, or delete sourcetype renaming configurations they own within apps they lack permission to access. This occurs because Sp...
CVE-2026-76296 Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is...
CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
CVE-2026-76288
Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to a Denial of Service (DoS) attack. An unauthenticated user can send a single crafted request to the Splunk Web JavaScript logger endpoint , causing Splunk Web to stop responding until the service is restarted. T...
PT-2026-120851
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user with the edit manager xml capability can execute...
Splunk: CVE-2026-76288: Security Vulnerabilities in Splunk Enterprise - October 2026
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
PT-2026-120846
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description An unauthenticated user can cause Splunk Web to stop...
PT-2026-120854
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is...
Splunk Enterprise resource management error vulnerability
Versions prior to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a resource management error vulnerability. This vulnerability arises because Splunk Web fails to restrict header parsing prior to processing requests. Unauthenticated attackers can send a specially crafted request to...
Splunk Enterprise authorization issue vulnerability
Versions prior to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain an authorization issue vulnerability. This vulnerability arises because when Splunk Web is enabled, the required application privileges are not verified prior to performing sourcetype renaming operations. As a result,...
Splunk Enterprise code injection vulnerability
Versions prior to Splunk Enterprise 10.4.3, 10.2.8, 10.0.11, and 9.4.16 contain a code injection vulnerability. This vulnerability arises from insufficient restrictions on expression syntax when processing user-controllable expressions within the Splunk Web Evaluation Manager XML. As a result,...