CVE-2026-107279 is a high-severity vulnerability in AsyncHttpClient version 3.0.12 where the authentication algorithm incorrectly handles Digest qop=auth-int. This flaw causes the mutual-authentication verification to be skipped, allowing a peer that does not know the shared secret to be accepted as an authenticated server. The issue is fixed in version 3.0.13.
AsyncHttpClient versions prior to 3.0.12 on the 3.x branch and 2.16.1 on the 2.x branch have a vulnerability where sensitive credentials can be transmitted in cleartext over a proxy connection. This occurs because the client incorrectly infers proxy tunnel status, allowing authorization credentials to be sent without encryption after a proxy rejects a CONNECT request. The issue is fixed in versions 3.0.12 and 2.16.1.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability where Digest authentication challenges with missing or empty nonces are incorrectly treated as Basic authentication challenges. This causes the client to resend credentials in cleartext using Basic authentication, exposing sensitive information. The issue affects both origin and proxy challenge parsers and has been fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions from 2.0.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 contain an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in Kerberos, SPNEGO, NTLM, and proxy connections, potentially exposing one user's data or authority to another. The issue is fixed in version 3.0.14.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 have an improper authentication vulnerability. The enabled-by-default cookie store can overwrite explicitly set Cookie headers in HTTP requests, causing requests to execute under the wrong user session. This bypasses previous remediation efforts and can lead to session confusion. The issue is fixed in version 3.0.14.
Hackers compromised third-party operators managing the authoritative DNS records for the country-code top-level domains (ccTLDs) of Ghana (.GH), American Samoa (.AS), and Sierra Leone (.SL). By modifying these DNS records, attackers were able to obtain unauthorized HTTPS certificates for several Google domains and other organizations' domains within these ccTLDs. This allowed them to hijack domains, redirect traffic to attacker-controlled infrastructure, and impersonate legitimate brands. Google confirmed its own systems were not compromised and worked with certificate authorities to revoke the fraudulent certificates and block them in Chrome. The incident highlights risks associated with third-party DNS registry security and certificate issuance processes.
CVE-2026-76286 affects Splunk MCP Server versions 1.2 up to but not including 1.2.1. The vulnerability allows a user with the mcp_tool_execute capability to run a custom API tool that sends the user's Splunk platform authentication token to a URL controlled by another user. This could enable the attacker to capture the token and impersonate the original user to access data and perform actions. The issue arises because the server does not sufficiently verify that the URL request is sent to the expected destination.
CVE-2026-76285 is a critical vulnerability in Splunk Enterprise caused by improper adherence to coding standards, categorized under CWE-710. It affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without authentication and results in high impact on confidentiality, integrity, and availability. Cisco addressed this issue through a software hardening release as part of an internal security review.
CVE-2026-76284 is a critical vulnerability in Splunk Enterprise where the product fails to ensure that structured messages or data are well-formed and that certain security properties are met before processing. This issue relates to improper neutralization of input, categorized under CWE-707. The vulnerability affects multiple versions of Splunk Enterprise prior to specific patch releases. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-76283 is a high-severity vulnerability in Splunk Enterprise involving failure or incorrect use of protection mechanisms, categorized under CWE-693. It affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability allows an attacker with low privileges to cause high confidentiality impact, low integrity impact, and low availability impact. No known exploits are reported in the wild. The vendor has released software hardening updates addressing this issue.
CVE-2026-76282 is a high-severity vulnerability in Splunk Enterprise involving improper control of a resource throughout its lifecycle. This flaw affects multiple versions of Splunk Enterprise prior to certain patch releases. The vulnerability is classified under CWE-664, indicating issues with resource management. It has a CVSS score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vulnerability was identified during Cisco's internal security review and addressed in subsequent software hardening releases.
CVE-2026-76281 is an improper access control vulnerability in Splunk Enterprise that allows unauthorized actors to access restricted resources. The issue was identified during Cisco's internal security review and affects multiple versions of Splunk Enterprise prior to specific patch releases. The vulnerability has a medium severity rating with a CVSS score of 5.3 and impacts confidentiality but does not affect integrity or availability.
CVE-2026-76280 affects certain versions of Splunk Enterprise and Splunk Secure Gateway. It allows authenticated users without admin roles to modify alert and mobile-device recipient data stored in App Key Value Store collections. This occurs because these collections improperly allow unrestricted write access instead of restricting it to authorized workflows. The vulnerability impacts versions prior to specific fixed releases in both Splunk Enterprise and Splunk Secure Gateway.
CVE-2026-76279 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users with the run_collect capability to write events to internal indexes beyond their configured index access. This occurs because Splunk Enterprise does not normalize whitespace in index names before enforcing index-access restrictions. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-76278 is a medium-severity vulnerability in Splunk Enterprise that affects certain versions before 10.4.3, 10.2.7, and 10.0.10. It allows users with the edit_spl2_module_permissions capability to access SPL2 module permission grants for modules they should not be authorized to view. This occurs because the affected REST API does not verify if the user has read access to the requested app before returning permission data. Versions 9.4.x are not affected.
CVE-2026-76277 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users with the edit_user capability to create native Splunk usernames ending with a period due to improper username validation. This can cause distinct usernames to share configuration data, leading to user-management operations affecting incorrect accounts or failing.
CVE-2026-76276 affects Splunk Enterprise versions prior to 10.4.3, 10.2.7, and 10.0.10. A low-privileged user without admin or power roles can access original source code of the Discover Splunk Observability Cloud app via Splunk Web due to embedded source maps in JavaScript bundles. This vulnerability does not affect version 9.4.x. The CVSS score is 4.3, indicating medium severity.
CVE-2026-76275 is a medium severity vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users without admin or power roles to access search query text and job metadata belonging to other users via a REST API due to insufficient authorization checks. This exposure includes job identifiers, dispatch parameters, result counts, and execution metadata.
CVE-2026-76274 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, and 10.0.10. It allows a user with the read_o11y_content capability to redirect outbound REST API requests from the Splunk App for Splunk Observability Cloud to an attacker-controlled host, potentially exposing the configured Observability Cloud API token. This occurs because the app does not fully validate the destination of outbound requests. Splunk Enterprise 9.4.x versions are not affected.
CVE-2026-76273 is a medium severity vulnerability in Splunk Enterprise that affects versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows a user with the run_collect capability to use the collect SPL command to insert attacker-controlled content into system-level messages due to improper validation of the index name. This could affect the control or data flow within the Splunk platform instance.