CVE-2026-76355 Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prio...

CVE-2026-76355 Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prio...

CVE-2026-76354 Path Traversal through Search Head Clustering in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-76354

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by a path traversal vulnerability in the Search Head Clustering bundle replication mechanism. The root cause is that the system does not validate replicated bundle file names or neutralize NUL bytes before constructi...

CVE-2026-76352

CVE-2026-76352 is an improper authorization vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. An...

CVE-2026-76353 Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76352 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76352 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76353

CVE-2026-76353 is a path traversal vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that knowledge bundle delta processing does not restrict removal paths to the staging directory, and the endpoint does not enforce the expected authorization...

CVE-2026-76351 Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76351

CVE-2026-76351 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) and Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14). The root cause is that Secure Gateway does not validate decoded report notification identifiers before constru...

CVE-2026-76351 Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76350 Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76350

CVE-2026-76350 is an improper privilege management vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the schedule_search role capability can configure PDF attachments in the email alert action workflow. When the alert fires, the search...

CVE-2026-76349

CVE-2026-76349 is an SPL injection vulnerability in Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14 (not affecting 10.4+). The root cause is that Splunk Web substitutes form token values from URLs into SPL searches without neutralizing them , allowing an unauthenticated attacker to cr...

CVE-2026-76350 Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76349 SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-76348 Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...

CVE-2026-76348

CVE-2026-76348 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The vulnerability resides in Search Head Cluster member control endpoints , which do not require a state-changing HTTP request type before applying read-only authorization. A user holding the high-privile...