CVE-2026-76527

This vulnerability affects Splunk SOAR and is associated with CWE-703 , involving improper check or handling of exceptional conditions . These issues were identified during a proactive internal security review by Cisco, leading to a software hardening release. No specific technical root cause, af...

CVE-2026-76526

The Splunk SOAR platform is affected by CVE-2026-76526 , which involves improper neutralization vulnerabilities categorized under CWE-707 . These issues were identified during an internal security review by Cisco as part of a software hardening release. No specific technical root cause, affected ...

CVE-2026-76408

This vulnerability affects Splunk SOAR and is categorized under CWE-664: Improper Control of a Resource Through its Lifetime . The issue was identified during an internal security review by Cisco , resulting in a software hardening release to address multiple internally discovered vulnerabilities...

CVE-2026-76407

CVE-2026-76407 addresses improper access control vulnerabilities (CWE-284) within Splunk SOAR . These issues were identified during a proactive internal security review conducted by Cisco and are addressed through a software hardening release . No specific technical root causes, affected versions...

CVE-2026-76406

Versions of Splunk SOAR below 8.7.0 are vulnerable to an information disclosure flaw in the REST API . The root cause is that the system decrypts encrypted Basic authentication values before completing the necessary authentication checks. An unauthenticated user who already possesses encrypted cr...

CVE-2026-76308

In Splunk SOAR versions prior to 8.7.0 , an authenticated user can modify the Enterprise Security edition via the REST API . The root cause is a missing authorization check where the system authenticates the request but fails to verify the caller's permissions before applying the license change. ...

CVE-2026-76307

Splunk SOAR versions below 8.7.0 are vulnerable to a sensitive information disclosure flaw. A user with Users and Roles view permissions can use the REST API to infer authentication token values for other users. This is caused by the API accepting caller-controlled query filters on sensitive user...

CVE-2026-76306

In Splunk SOAR versions below 8.7.0 , an attacker with the Observer role can exploit an information disclosure vulnerability to infer password hashes and authorization tokens of other users. This issue occurs because the software applies REST API query filters to user records before protecting se...

CVE-2026-76305

Splunk SOAR versions below 8.7.0 are vulnerable to an improper access control issue (CWE-862) where the system fails to verify permissions before returning an app archive. An authenticated user without the necessary permissions to view apps can download these archives, potentially exposing propri...

CVE-2026-76304

In Splunk SOAR versions below 8.7.0 , an authenticated user without permissions to edit Automation Brokers can download the Docker Compose configuration file . This is caused by a failure to enforce proper authorization checks when returning the configuration file. The disclosed file contains the...

CVE-2026-76303

In Splunk SOAR versions below 8.7.0 , a Stored Cross-Site Scripting (XSS) vulnerability exists because the application fails to sanitize app documentation content. An attacker with the install_apps capability can install an app containing malicious content. If a user with permission to view apps ...

CVE-2026-76302 Security Hardening in Splunk Enterprise - October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

CVE-2026-76302

CVE-2026-76302 identifies a security hardening release in Splunk Enterprise (October 2026) addressed by Cisco. The vulnerability involves improper neutralization issues categorized under CWE-707 . While the internal review identified multiple vulnerabilities, specific technical details regarding ...

CVE-2026-76300

The Splunk Enterprise software is affected by multiple vulnerabilities associated with CVE-2026-76300 . These issues stem from the improper control of a resource through its lifetime , categorized under CWE-664 . The vulnerabilities were identified during a comprehensive internal security review ...

CVE-2026-76301

The Splunk Enterprise software includes a security hardening release addressing multiple internally discovered vulnerabilities. These issues are categorized as Protection Mechanism Failures under CWE-693 . While the specific technical root causes and impacted components are not detailed in the pr...

CVE-2026-76299 Security Hardening in Splunk Enterprise - October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

CVE-2026-76299

This vulnerability affects Splunk Enterprise and is part of a software hardening release from Cisco. The issue is attributed to improper access control (CWE-284) discovered during an internal security review. While the specific technical root cause is not detailed beyond the CWE classification, t...

CVE-2026-76298 Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

CVE-2026-76298

In Splunk Enterprise versions below 10.4.4 and 10.2.8 , a security flaw exists in the PostgreSQL sidecar service due to the use of a hard-coded cryptographic key . Specifically, the service derives a privileged database password from the search head cluster identifier, which is exposed in search ...

CVE-2026-76297 Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the editfederatedproviders capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches fr...