# Splunk vulnerabilities Source: https://junglewise.ai/threats/vendors/splunk Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/splunk.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 116 vulnerabilities in Splunk: 0 in the last 7 days and 93 in the last 90 days, 6 of them critical and 1 exploited in the wild. The most recent, CVE-2026-76531, was published on 21 October 2026. 31 vulnerabilities in the last four weeks, up 520% on the four before (5). 0 critical against 2. 7 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 31 - Last 90 days: 93 - All time: 116 (6 critical, 1 exploited in the wild) ## About Splunk Splunk is an American software company that produces software for searching, monitoring, and analyzing machine-generated big data. ## Latest Splunk vulnerabilities - [CVE-2026-76531: Splunk SOAR files or directories accessible to external parties](https://junglewise.ai/threats/cve-2026-76531-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76530: Splunk SOAR authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-76530-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76529: Splunk SOAR improper protection of alternate path](https://junglewise.ai/threats/cve-2026-76529-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76528: Splunk SOAR protection mechanism failure](https://junglewise.ai/threats/cve-2026-76528-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76527: Splunk SOAR improper handling of exceptional conditions](https://junglewise.ai/threats/cve-2026-76527-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76526: Splunk SOAR improper neutralization in security hardening](https://junglewise.ai/threats/cve-2026-76526-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76408: Splunk SOAR improper resource control](https://junglewise.ai/threats/cve-2026-76408-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76407: Splunk SOAR improper access control](https://junglewise.ai/threats/cve-2026-76407-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76406: Splunk SOAR credential decryption via REST API authentication](https://junglewise.ai/threats/cve-2026-76406-in-splunk-soar-versions-below-8-7-0-an-unauthenticated-user-with) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2026-76308: Splunk SOAR missing authorization through REST API](https://junglewise.ai/threats/cve-2026-76308-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-could) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-76307: Splunk SOAR authentication token disclosure in REST API](https://junglewise.ai/threats/cve-2026-76307-in-splunk-soar-versions-below-8-7-0-a-user-that-holds-a-role-with) (high, CVSS 7.2, published 21 Oct 2026) - [CVE-2026-76306: Splunk SOAR information disclosure through REST API query filters](https://junglewise.ai/threats/cve-2026-76306-in-splunk-soar-versions-below-8-7-0-a-user-that-has-the-observer) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-76305: Splunk SOAR improper access control during app downloads](https://junglewise.ai/threats/cve-2026-76305-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-who) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-76304: Splunk SOAR access control bypass in Automation Broker configuration](https://junglewise.ai/threats/cve-2026-76304-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-who) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-76303: Splunk SOAR stored cross-site scripting in app documentation](https://junglewise.ai/threats/cve-2026-76303-in-splunk-soar-versions-below-8-7-0-a-user-that-holds-a-role-with) (medium, CVSS 5.7, published 21 Oct 2026) - [CVE-2026-76302: Splunk Enterprise improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76302-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76301: Splunk Enterprise protection mechanism failure](https://junglewise.ai/threats/cve-2026-76301-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76300: Splunk Enterprise improper resource control](https://junglewise.ai/threats/cve-2026-76300-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76299: Splunk Enterprise improper access control](https://junglewise.ai/threats/cve-2026-76299-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76298: Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecar](https://junglewise.ai/threats/cve-2026-76298-in-splunk-enterprise-versions-below-10-4-4-and-10-2-8-a-user-who) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-76297: Splunk Enterprise federated search provider CSRF state change](https://junglewise.ai/threats/cve-2026-76297-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4) (medium, CVSS 4.2, published 21 Oct 2026) - [CVE-2026-76296: Splunk Enterprise missing authorization in sourcetype renaming](https://junglewise.ai/threats/cve-2026-76296-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-76295: Splunk Enterprise SPL injection in REST API through Secure Gateway](https://junglewise.ai/threats/cve-2026-76295-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-76294: Splunk Enterprise improper access control in field extraction management](https://junglewise.ai/threats/cve-2026-76294-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-76293: Splunk Enterprise remote code execution in Web Manager XML parsing](https://junglewise.ai/threats/cve-2026-76293-in-splunk-enterprise-versions-below-10-4-3-10-2-8-10-0-11-and-9-4) (high, CVSS 7.2, published 21 Oct 2026) ## Most severe Splunk vulnerabilities - [CVE-2026-20253: Splunk Enterprise auth bypass in PostgreSQL sidecar service](https://junglewise.ai/threats/cve-2026-20253-splunk-enterprise-auth-bypass-in-postgresql-sidecar-service) (critical, exploited in the wild, CVSS 9.8, published 10 Jun 2026) - [CVE-2026-76284: Splunk Enterprise improper neutralization](https://junglewise.ai/threats/cve-2026-76284-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (critical, CVSS 9.8, published 7 Oct 2026) - [CVE-2026-76285: Splunk Enterprise improper adherence to coding standards](https://junglewise.ai/threats/cve-2026-76285-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (critical, CVSS 9.8, published 7 Oct 2026) - [CVE-2026-76311: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded…](https://junglewise.ai/threats/cve-2026-76311-in-splunk-enterprise-versions-below-10-4-2-10-2-6-10-0-9-and-9-4) (critical, CVSS 9.4, published 19 Aug 2026) - [CVE-2026-76404: Splunk MCP Server app remote code execution through deserialization](https://junglewise.ai/threats/cve-2026-76404-splunk-mcp-server-app-remote-code-execution-through) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-20266: Splunk AI Toolkit OS command injection in btool configuration helper](https://junglewise.ai/threats/cve-2026-20266-splunk-ai-toolkit-os-command-injection-in-btool-configuration) (critical, CVSS 9.1, published 17 Jun 2026) - [CVE-2026-76395: Splunk AI Toolkit RCE through unsafe model deserialization](https://junglewise.ai/threats/cve-2026-76395-splunk-ai-toolkit-rce-through-unsafe-model-deserialization) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-76351: Splunk Enterprise privilege escalation via report notification data](https://junglewise.ai/threats/cve-2026-76351-splunk-enterprise-privilege-escalation-via-report-notification) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-76282: Splunk Enterprise improper control of resource through lifetime](https://junglewise.ai/threats/cve-2026-76282-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (high, CVSS 8.8, published 7 Oct 2026) - [CVE-2026-76259: In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access…](https://junglewise.ai/threats/cve-2026-76259-in-splunk-enterprise-for-windows-versions-below-10-4-2-10-2-6-10) (high, CVSS 8.8, published 19 Aug 2026) ## Vulnerabilities per week 31 vulnerabilities in the last four weeks, up 520% on the four before (5). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 57 | 2 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 5 | 2 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 31 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Splunk technologies - [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise): 32 vulnerabilities - [Splunk SOAR](https://junglewise.ai/threats/technologies/soar): 31 vulnerabilities - [Splunk](https://junglewise.ai/threats/technologies/splunk): 20 vulnerabilities - [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform): 19 vulnerabilities - [Splunk AI Toolkit](https://junglewise.ai/threats/technologies/ai-toolkit): 12 vulnerabilities - [Splunk Secure Gateway](https://junglewise.ai/threats/technologies/secure-gateway): 10 vulnerabilities - [Splunk Connect For Kafka](https://junglewise.ai/threats/technologies/connect-for-kafka): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Splunk vulnerabilities", https://junglewise.ai/threats/vendors/splunk, 13 November 2026.