CVE-2026-76259 is a high-severity vulnerability in Splunk Enterprise for Windows that affects versions prior to 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14. A local user with access to the Windows host can bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use these tokens to compromise data and system integrity. This occurs because the management-port listener does not enforce exclusive address binding protections before service startup.
CVE-2026-76258 affects multiple versions of Splunk Enterprise and Splunk Secure Gateway. It involves a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler, which allows a non-admin or non-power user to register an arbitrary companion app. This can cause mobile user requests, including sensitive tokens, to be forwarded to an attacker-controlled URL, potentially exposing sensitive data. The vulnerability impacts versions prior to specific fixed releases in both Splunk Enterprise and Splunk Secure Gateway.
CVE-2026-76257 is a vulnerability in Splunk Enterprise and Splunk Secure Gateway where certain REST API endpoints do not enforce proper authorization checks. This allows users with roles that can list storage passwords, but without Secure Gateway admin privileges, to access Mobile Device Management signing secrets. The flaw affects multiple versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71. The vulnerability could compromise mobile-device enrollment trust. The CVSS score is 6.5 (medium severity).
CVE-2026-76256 is a medium severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where users without admin or power roles can access sensitive Security Assertion Markup Language (SAML) setup and instance settings via certain REST API endpoints. This occurs because the affected endpoints do not properly enforce authorization checks before returning configuration data. The issue affects multiple versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The vulnerability allows unauthorized information disclosure but does not impact integrity or availability. No known exploits are reported in the wild. Patch status is not explicitly stated in the provided data, so users should consult vendor advisories for remediation guidance.
CVE-2026-76255 is a vulnerability in Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.8, and 9.4.13 where insufficient authorization checks allow a non-admin or non-power user to trick another user into executing arbitrary SPL commands via the Data Model Editor. This occurs because Splunk Web does not apply safeguards for risky commands during certain base searches. Exploitation requires phishing the affected user to initiate a request in their browser. The vulnerability can lead to unauthorized data access and impact system integrity.
CVE-2026-76254 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. It allows an unauthenticated attacker to cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines with that user's privileges via Dataset Explorer. This occurs because Dataset Explorer fails to properly validate or escape dataset names and does not apply SPL safeguards for risky commands. Exploitation requires phishing the victim to open a crafted link, so the attacker cannot exploit it at will. The vulnerability impacts data confidentiality, integrity, and system availability.
CVE-2026-76253 is a privilege management vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users with the schedule_search capability can execute arbitrary SPL commands with the highest system privileges, allowing them to read and modify all stored credentials and potentially impact system integrity and availability. This occurs because scheduled search alert action configurations do not properly restrict user-specific alert action settings before execution.
CVE-2026-76252 is a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.13. It allows an unauthenticated attacker to trick a user into visiting a malicious web page, causing unauthorized JavaScript execution in that user's browser. This can lead to unauthorized access to data and actions affecting system integrity. Exploitation requires user interaction via phishing, and the attacker cannot exploit it without the user initiating a request.
CVE-2026-76251 is a vulnerability in Splunk Enterprise versions 10.0 up to but not including 10.0.9, 10.2 up to but not including 10.2.6, and 10.4 up to but not including 10.4.2. It allows users without admin or power roles to cause the Splunk App for Splunk Observability Cloud to forward requests with the stored access token, potentially exposing data and allowing limited changes in Splunk Observability Cloud. The issue arises because the app's REST API does not enforce proper authorization checks before forwarding requests. Versions 9.3 and 9.4 are not affected.
A vulnerability in Splunk Enterprise and Splunk Cloud Platform versions prior to certain fixed releases allows low-privileged users without 'admin' or 'power' roles to access stored credential hashes via the |rest SPL command querying the /servicesNS/-/-/storage/passwords REST endpoint. This exposure occurs because the encr_password field is returned in the results, potentially leaking sensitive credential information.
CVE-2026-20296 is a high-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform versions prior to specified fixed releases. It allows an attacker to trick a user with the 'list_deployment_server' capability into executing arbitrary SPL searches as the splunk-system-user. This occurs because Deployment Server endpoints do not validate CSRF tokens on GET requests and improperly neutralize user input before embedding it into SPL searches.
CVE-2026-20297 is a path traversal vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows users with specific app installation privileges to write files outside the intended app directory. This occurs because the software does not properly sanitize pathname elements during app installation, enabling writes into the broader $SPLUNK_HOME/etc/ directory and its subdirectories. The vulnerability affects multiple versions of Splunk Enterprise and Cloud Platform prior to certain fixed releases. The CVSS score is 7.2, indicating high severity due to potential confidentiality, integrity, and availability impacts.
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.
The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration.
The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user.
The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
Splunk Enterprise versions 10.2 prior to 10.2.4 and 10.0 prior to 10.0.7 contain a critical vulnerability where the PostgreSQL sidecar service endpoint does not require authentication. This allows unauthenticated network users to create or truncate arbitrary files. Versions 9.4 and earlier are not affected. Disabling the PostgreSQL sidecar service can mitigate the issue if immediate upgrading is not possible.
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.