Splunk vulnerabilities and fixes

CVEs that mention Splunk, ranked by priority. 27 tracked.

Splunk has 27 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-10-21. Highest priority: CVE-2022-43552 (score 52/100).

• CVE-2022-43552 MEDIUM 5.9 UPGRADE UPGRADE A use after free vulnerability exists in curl <7.87.0
• CVE-2026-76311 CRITICAL 9.4 UPGRADE In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an emb
• CVE-2026-76404 CRITICAL 9.1 UPGRADE In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrar
• CVE-2026-76290 HIGH 7.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated r
• CVE-2026-76288 HIGH 7.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a
• CVE-2026-76291 HIGH 8.8 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the sch
• CVE-2026-76298 HIGH 8.8 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk
• CVE-2026-76259 HIGH 8.8 UPGRADE In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with
• CVE-2026-76293 HIGH 7.2 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edi
• CVE-2026-76390 MEDIUM 5.3 UPGRADE In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could
• CVE-2026-76406 MEDIUM 5.9 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an
• CVE-2026-76307 HIGH 7.2 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could u
• CVE-2026-76306 HIGH 7.5 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Repres
• CVE-2026-76289 MEDIUM 6.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76292 MEDIUM 6.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions be
• CVE-2026-76305 MEDIUM 6.5 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view ap
• CVE-2026-76308 MEDIUM 6.5 In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition throug
• CVE-2026-76303 MEDIUM 5.7 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store att
• CVE-2026-76376 MEDIUM 4.3 In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run act
• CVE-2026-76287 MEDIUM 5.4 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline
• CVE-2026-76294 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76296 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76383 MEDIUM 4.3 In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role
• CVE-2026-76295 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions be
• CVE-2026-76384 MEDIUM 4.3 In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with
• CVE-2026-76304 MEDIUM 4.3 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Au
• CVE-2026-76297 MEDIUM 4.2 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a

FAQ

How do I fix Splunk vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Splunk being exploited right now?

None of the tracked Splunk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Splunk CVE should I patch first?

CVE-2022-43552 currently ranks highest (52/100): A use after free vulnerability exists in curl <7.87.0.

← Back to latest CVEs