[NEW] [high] Splunk Splunk Enterprise: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Splunk Splunk Enterprise to execute arbitrary code, escalate privileges, bypass security measures, perform SQL injection, server-side request forgery and cross-site scripting attacks, disclose or manipulate sensitive information, trigger denial-of-service conditions, or perform other unspecified attacks.
CSIRTS triage
- What
- Multiple vulnerabilities allow remote code execution, privilege escalation, authentication bypass, SQL injection, SSRF, XSS, information disclosure, and denial-of-service attacks.
- Who is affected
- All deployments of Splunk Enterprise.
- Urgency
- High priority due to multiple severe impact vectors including remote code execution and no authentication requirement mentioned.
- Action
- Apply Splunk security patches for all eight CVEs (CVE-2026-76251 through CVE-2026-76258) immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Splunk Enterprise
Get an email when a new Splunk Enterprise advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2929
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-762510.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762520.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762530.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762540.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762550.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762560.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762570.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762580.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762590.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-762600.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownNCSC-2026-0322 [1.00] [M/H] Vulnerabilities fixed in Splunk Enterprise by Splunkncsc-nl
- unknownSplunk Products Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
- highCVE-2026-76355: In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the in…nvd
- highCVE-2026-76354: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not ho…nvd
- mediumCVE-2026-76353: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not ho…nvd
- highCVE-2026-76352: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not ho…nvd
- highCVE-2026-76351: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gate…nvd
- highCVE-2026-76350: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a ro…nvd
- mediumCVE-2026-76349: In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could …nvd
- lowCVE-2026-76348: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Spl…nvd
- mediumCVE-2026-76347: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gate…nvd
Recent advisories for Splunk Splunk Enterprise
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0322 [1.00] [M/H] Vulnerabilities fixed in Splunk Enterprise by Splunkncsc-nl · 2026-08-21
- mediumCVE-2026-76390: In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthentic…nvd · 2026-08-19
- highCVE-2026-76388: In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk En…nvd · 2026-08-19
- highCVE-2026-76387: In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Secur…nvd · 2026-08-19
- highCVE-2026-76355: In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the in…nvd · 2026-08-19
- highCVE-2026-76354: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not ho…nvd · 2026-08-19
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25