Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
Classification: Critical, Solution: Not Defined, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more…
Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise. In Splunk Enterprise zijn verschillende kwetsbaarheden aanwezig in versies eerder dan 10.4.4 (en enkele andere specifieke versies). Deze omvatten onder andere: - onjuiste verificatie in de Data Management REST API waardoor gebruikers met bepaalde rollen toegang kunnen krijgen tot of verwijderen van SPL2 preview jobs en resultaten die zij niet bezitten - onvoldoende limieten in request-header parsing in de JavaScript logger…
Serial number: AV26-1077 Date: October 22, 2026 As of October 21, 2026, Splunk is affected by vulnerabilities in the following products: Splunk Enterprise Prior to 10.0.11 Prior to 10.2.8 Prior to 10.4.4 Prior to 9.4.16 Splunk SOAR Prior to 8.7.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Hardening in Splunk Enterprise - October 2026 Security Vulnerabilities in Splunk SOAR - October…
Splunk ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui 4 con gravità “critica” e 13 con gravità “alta”, nei prodotti Splunk SOAR e Splunk Enterprise. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in alcuni casi non autenticato, di accedere a informazioni sensibili, di eludere i meccanismi di autenticazione e di autorizzazione o di eludere le misure di sicurezza.
De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.
Splunk addressed multiple vulnerabilities in Splunk SOAR version 8.7.0. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Splunk addressed multiple internally identified vulnerabilities in Splunk SOAR version 8.7.0. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
On October 21, 2026, Splunk PSIRT will publish advisories to disclose security vulnerability advisories for Splunk Enterprise, Universal Forwarder, and SOAR.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-76281, CVE-2026-76282, CVE-2026-76283, CVE-2026-76284, CVE-2026-76285, Summary: Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group.
Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise. De kwetsbaarheden betreffen verschillende versies van Splunk Enterprise en omvatten onder andere onvoldoende autorisatiecontroles in REST API endpoints, waardoor niet-bevoegde gebruikers toegang kunnen krijgen tot geprivilegieerde functionaliteit of gevoelige gegevens. Sommige kwetsbaarheden maken het mogelijk voor gebruikers zonder admin- of power-rollen om configuratiewijzigingen door te voeren, payloads te laten…
Serial number: AV26-1018 Date: October 8, 2026 As of October 7, 2026, Splunk is affected by vulnerabilities in the following products: Splunk Enterprise Prior to 10.0.10 Prior to 10.2.7 Prior to 10.4.3 Prior to 9.4.15 Splunk MCP Server Prior to 1.2.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Vulnerabilities in Splunk Enterprise - September/October 2026 - SVD-2026-1001 Security…
Rilevate molteplici nuove vulnerabilità in prodotti Splunk, di cui 3 con gravità "critica" e 3 con gravità "alta" in Splunk Enterprise. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato, in determinate condizioni, di eseguire codice arbitrario, eludere meccanismi di sicurezza ed elevare i propri privilegi sui sistemi interessati.
De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user who holds a role that contains the mcp_tool_execute capability to run a custom API tool…
On September 16, 2026, Splunk PSIRT will publish advisories to disclose security vulnerability advisories for Splunk Enterprise, Universal Forwarder, and Splunk Apps and Add-ons.
Serial Number: AV26-838Date: August 21, 2026 As of August 19, 2026, Splunk is affected by vulnerabilities in the following products: Cisco Talos Intelligence for Enterprise Security Cloud Prior to 1.0.3 Splunk Enterprise Prior to 10.0.9 Prior to 10.2.6 Prior to 10.4.1 Prior to 10.4.2 Prior to 9.4.14 Splunk MCP Server app Prior to 1.2.1 Splunk Universal Forwarder Prior to 10.4.2 Prior to 10.2.6 Prior to 10.0.9 Prior to 9.4.14 Splunk SOAR Prior to 8.6.0 Splunk SOAR Connectors Multiple versions…
Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14. De kwetsbaarheden in Splunk Enterprise betreffen onder andere: - Onvoldoende handhaving van authenticatie- en autorisatiecontroles in REST API's, waardoor niet-bevoegde gebruikers toegang kunnen krijgen tot gevoelige data, configuraties en kunnen leiden tot het uitvoeren van willekeurige SPL-commando's met verhoogde privileges. - Meerdere kwetsbaarheden die Cross-Site…
De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. See CVE Details for vulnerability-specific information.
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and higher.
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and higher.
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the list_deployment_server capability into running arbitrary Search Processing Language (SPL) searches on their behalf as splunk-system-user, allowing for access to stored credentials and indexed data.The vulnerability is possible because Deployment Server…
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the edit_local_apps and install_apps capabilities could cause a legitimate app installation to write files outside the intended app directory, into $SPLUNK_HOME/etc/ and its subdirectories.The vulnerability is caused by a path traversal in the app installation workflow, which does…
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could view stored credential hashes when they access the /servicesNS/-/-/storage/passwords REST endpoint through the |rest Search Processing Language (SPL) command.The exposure happens because the |rest SPL command returns the encr…
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the “admin” or “power” Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration. The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.
In Splunk AI Toolkit versions below 5.7.4, a user who holds the “admin” Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature. The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker…
In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server when a higher-privileged user views it, bypassing the external content restriction through a Cascading Style Sheets (CSS) injection.The Trusted Domains…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server. The vulnerability exists because URL validation on the external content dialog is incomplete, which can allow for requests to untrusted domains when a…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.The vulnerability exists because the URL classifier in classic dashboards only recognizes http://…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it. The exfiltration is possible because classic dashboard panels do not fully validate style attribute values, which can allow…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request…
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability edit_saved_search_owner could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lacks access control.
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, 9.3.13, and higher.
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.
When a company suffers a cyber breach, its stock price often takes a hit, but the timing, depth, and duration of that reaction are far less predictable. In this LABScon25 presentation, Mick Baccio and Scott Roberts explore whether public indicators of breach activity can be used to anticipate market response before formal disclosure. Drawing on sources such as EDGAR filings, executive blog posts, and social media chatter, the speakers examine how public breadcrumbs can reveal incident activity…