Technology · Splunk
Splunk Enterprise vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 32 vulnerabilities in Splunk Enterprise: 0 in the last 7 days and 21 in the last 90 days, 3 of them critical and 1 exploited in the wild. The most recent, CVE-2026-76302, was published on 21 October 2026. 16 vulnerabilities in the last four weeks, up 220% on the four before (5). 0 critical against 2.
- Last 7 days
- 0
- Last 90 days
- 21
- Critical, all time
- 3
- Exploited in the wild
- 1
About Splunk Enterprise
Splunk Enterprise is a software platform for searching, monitoring, and analyzing machine-generated data.
Latest Splunk Enterprise vulnerabilities
- CVE-2026-76302: Splunk Enterprise improper neutralization vulnerabilityinfo
- CVE-2026-76301: Splunk Enterprise protection mechanism failureinfo
- CVE-2026-76300: Splunk Enterprise improper resource controlinfo
- CVE-2026-76299: Splunk Enterprise improper access controlinfo
- CVE-2026-76298: Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecarhighCVSS 8.8
- CVE-2026-76297: Splunk Enterprise federated search provider CSRF state changemediumCVSS 4.2
- CVE-2026-76296: Splunk Enterprise missing authorization in sourcetype renamingmediumCVSS 4.3
- CVE-2026-76295: Splunk Enterprise SPL injection in REST API through Secure GatewaymediumCVSS 4.3
- CVE-2026-76294: Splunk Enterprise improper access control in field extraction managementmediumCVSS 4.3
- CVE-2026-76293: Splunk Enterprise remote code execution in Web Manager XML parsinghighCVSS 7.2
- CVE-2026-76292: Splunk Enterprise missing authorization through REST API endpointsmediumCVSS 6.5
- CVE-2026-76291: Splunk Enterprise improper access control in scheduled search safeguardshighCVSS 8.8
- CVE-2026-76290: Splunk Enterprise denial of service through unauthenticated package downloadshighCVSS 7.5
- CVE-2026-76289: Splunk Enterprise denial of service in REST API lookup table endpointmediumCVSS 6.5
- CVE-2026-76288: Splunk Enterprise denial of service via Content-Type header parsinghighCVSS 7.5
- CVE-2026-76287: Splunk Enterprise authorization bypass in Data Management REST APImediumCVSS 5.4
- CVE-2026-76285: Splunk Enterprise improper adherence to coding standardscriticalCVSS 9.8EPSS 0.3%
- CVE-2026-76284: Splunk Enterprise improper neutralizationcriticalCVSS 9.8EPSS 0.3%
- CVE-2026-76283: Splunk Enterprise protection mechanism failurehighCVSS 7.6EPSS 0.2%
- CVE-2026-76282: Splunk Enterprise improper control of resource through lifetimehighCVSS 8.8EPSS 0.3%
- CVE-2026-76281: Splunk Enterprise improper access controlmediumCVSS 5.3EPSS 0.2%
- CVE-2026-20298: Splunk Enterprise and Cloud Platform information disclosure in REST APImediumCVSS 5.3
- CVE-2026-20297: Splunk Enterprise path traversal in App Install REST endpointhighCVSS 7.2
- CVE-2026-20296: Splunk Enterprise CSRF and SPL injection in Deployment ServerhighCVSS 8.3
- CVE-2026-20259: Splunk Enterprise improper access control in saved search ownershipmediumCVSS 5.5
Most severe Splunk Enterprise vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-20253: Splunk Enterprise auth bypass in PostgreSQL sidecar servicecriticalexploited in the wildCVSS 9.8EPSS 1.7%
- CVE-2026-76284: Splunk Enterprise improper neutralizationcriticalCVSS 9.8EPSS 0.3%
- CVE-2026-76285: Splunk Enterprise improper adherence to coding standardscriticalCVSS 9.8EPSS 0.3%
- CVE-2026-76282: Splunk Enterprise improper control of resource through lifetimehighCVSS 8.8EPSS 0.3%
- CVE-2026-76298: Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecarhighCVSS 8.8
- CVE-2026-76291: Splunk Enterprise improper access control in scheduled search safeguardshighCVSS 8.8
- CVE-2026-20296: Splunk Enterprise CSRF and SPL injection in Deployment ServerhighCVSS 8.3
- CVE-2026-76283: Splunk Enterprise protection mechanism failurehighCVSS 7.6EPSS 0.2%
- CVE-2026-20252: Splunk Enterprise SSRF in Dashboard Studio PDF exporthighCVSS 7.6
- CVE-2026-76290: Splunk Enterprise denial of service through unauthenticated package downloadshighCVSS 7.5
Vulnerabilities per week
16 vulnerabilities in the last four weeks, up 220% on the four before (5). 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 5 | 2 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 16 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Splunk Enterprise vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/splunk-enterprise)<a href="https://junglewise.ai/threats/technologies/splunk-enterprise"><img src="https://junglewise.ai/threats/technologies/splunk-enterprise/badge.svg" alt="Splunk Enterprise vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/splunk-enterprise.json, and this page as text at https://junglewise.ai/threats/technologies/splunk-enterprise.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Splunk Enterprise vulnerabilities", https://junglewise.ai/threats/technologies/splunk-enterprise, 9 November 2026.