CVE-2026-76361 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk SOAR versions prior to 8.6.0. An administrator user can exploit the /rest/support/connectivity/.../check_connectivity endpoint to make the server initiate outbound network connections to arbitrary destinations without sufficient validation. This allows the attacker to probe internal hosts and ports for reachability. The vulnerability has a low severity score and does not impact confidentiality, integrity, or availability beyond limited information disclosure about network reachability.
CVE-2026-76360 is a vulnerability in Splunk SOAR versions prior to 8.6.0 where an authenticated user without an assigned role can access the /rest/health endpoint. This endpoint exposes system and cluster telemetry information that should be restricted to administrative or support users. The issue arises from a missing authorization check, allowing unauthorized access to sensitive system health data.
CVE-2026-76359 is a path traversal vulnerability in Splunk SOAR versions prior to 8.6.0. It allows a user with Administrator privileges to exploit the Universal Forwarder installer's archive extraction process to write files outside the intended installation directory. This occurs because the extraction workflow does not properly verify that archive members remain within the designated destination directory. The vulnerability can lead to unauthorized file writes, impacting system integrity and availability.
CVE-2026-76358 is a path traversal vulnerability in Splunk SOAR versions prior to 8.6.0. It allows a user with app-install privileges to write files outside the intended temporary directory during app installation by exploiting improper validation of extracted file paths. This flaw exists in the archive extraction routine, which fails to ensure that file paths remain within the designated directory.
CVE-2026-76357 is a high-severity vulnerability in Splunk SOAR versions below 8.6.0. It allows an authenticated user without an assigned role to submit a crafted file path via the REST API, leading to arbitrary code execution. This occurs because the REST API does not require role assignment and fails to restrict file paths to the intended temporary directory.
CVE-2026-76356 is a high-severity vulnerability in Splunk SOAR versions prior to 8.6.0. It allows an unauthenticated attacker to spoof the source IP address in requests to the Automation Broker notification endpoint, leading to arbitrary code execution on the host. This occurs because the Automation Broker trusts a client-supplied source IP header as proof of local origin. Exploitation can compromise data confidentiality, system integrity, and availability.
CVE-2026-76355 is a vulnerability in Splunk Enterprise versions 10.4 up to but not including 10.4.2. It allows an unauthenticated user to retrieve Edge Processor pipeline configuration information via a REST API endpoint when the Edge Processor feature is enabled. This occurs because the Edge Processor service endpoint lacks authentication controls. Versions prior to 10.4 are not affected.
CVE-2026-76354 is a high-severity vulnerability in Splunk Enterprise affecting versions 9.4 through 9.4.14, 10.0 through 10.0.9, 10.2 through 10.2.6, and 10.4 through 10.4.2. It allows users without admin or power roles to send crafted REST API requests that can delete or temporarily overwrite files writable by the Splunk Enterprise process on non-captain search head cluster members. The issue arises from improper handling of NUL bytes in bundle replication paths during search head clustering, which can affect system integrity and availability.
CVE-2026-76353 is a path traversal vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to submit crafted knowledge bundle deltas that can delete arbitrary files accessible to the cluster manager. This occurs because the software does not properly restrict removal paths to the staging directory and fails to enforce authorization boundaries on the endpoint. The vulnerability can impact system integrity and disrupt service.
CVE-2026-76352 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users without admin or power roles to create or modify scripted lookups via generic configuration endpoints, executing lookup scripts with the permissions of the Splunk Enterprise service account. This improper authorization check can lead to unauthorized access to data and impact system integrity and availability.
CVE-2026-76351 is a high-severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where non-admin users can exploit crafted report notification data to cause the Secure Gateway to send requests to the Splunk Enterprise REST API using a system-level session token. This allows unauthorized modification of platform configuration and access to sensitive data without a password. The issue arises because the Secure Gateway does not properly validate decoded report notification identifiers before using them in API requests.
CVE-2026-76350 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users with the schedule_search capability to configure PDF attachments in email alert workflows that execute arbitrary SPL commands with system-level privileges. This occurs because the search scheduler incorrectly uses a system-level authentication context instead of the action owner's context when rendering PDF attachments, potentially exposing sensitive data and impacting system integrity and availability.
CVE-2026-76349 is a vulnerability in Splunk Enterprise versions prior to 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an authenticated user into executing arbitrary Search Processing Language (SPL) commands via a crafted Splunk Web link. This occurs because Splunk Web improperly handles form token values from URLs, failing to neutralize special elements that can alter query logic. Exploitation requires user interaction through phishing. The vulnerability is fixed in Splunk Enterprise 10.2.6 and later versions.
CVE-2026-76348 is a vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users with the high-privilege list_search_head_clustering role to send read requests to Search Head Cluster member control endpoints and change cluster state without proper authorization checks. This can lead to denial of service conditions. The issue arises because these endpoints do not require a state-changing HTTP request type before applying read-only authorization.
CVE-2026-76347 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Enterprise and Splunk Secure Gateway versions prior to specified fixed releases. It allows users without admin or power roles to send system-authenticated requests to internal Splunk services via report notifications. This can lead to unauthorized changes to Search Head Cluster state and denial of service conditions.
CVE-2026-76346 is a cross-site scripting (XSS) vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" role to store malicious scripts in dashboard sparkline format options, which execute in the browser of another user viewing the dashboard. If the victim user has the "admin" role, the script can access all data and perform actions with that user's permissions. The vulnerability arises because Splunk Web does not properly escape tooltip values or restrict dashboard visualization options to safe settings. Exploitation requires phishing to trick the victim into initiating a request. The vulnerability has a medium severity score of 5.4.
CVE-2026-76345 is a vulnerability in Splunk Enterprise versions 10.4 up to but not including 10.4.2. It allows a user with a high-privilege role that can manage search head clustering to exploit the search head cluster member bundle REST API to write files to locations writable by the Splunk Enterprise process. This could lead to remote code execution, impacting data confidentiality, integrity, and availability. Versions below 10.4 are not affected.