Threat reportVulnerabilityTL-2026-4136
Splunk Enterprise / Splunk SOAR and SolarWinds Security Updates (CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328)
Splunk Enterprise / Splunk SOAR and SolarWinds Security (TL-2026-4136), also tracked as Splunk October 2026 Security Advisories, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-22. It has no confirmed attribution, affects Splunk Splunk Enterprise, references 5 CVEs (CVE-2026-76299, CVE-2026-76302, CVE-2026-76531), maps to 7 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4136
- Threat ID
- TL-2026-4136
- Also known as
- Splunk October 2026 Security Advisories, SVD-2026-1008, SVD-2026-1011
- Severity
- CRITICAL
- CVSS
- 9.9
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, telecoms, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How Splunk Enterprise / Splunk SOAR and SolarWinds Security works
Splunk's October 2026 advisories fix critical (CVSS 9.9) access-control and neutralization flaws in Splunk Enterprise (9.4.16, 10.0.11, 10.2.8, 10.4.4) and a critical files-accessible flaw plus a 9.3 access-control flaw in Splunk SOAR (8.7.0). SolarWinds separately fixed a high-severity (CVSS 8.8) broken-authorization flaw, CVE-2026-28328, in Observability Self-Hosted 2026.4. No exploitation or public PoC is reported.
On 2026-10-21 Splunk published its October 2026 advisory set. For Splunk Enterprise, SVD-2026-1008 (Security Hardening) groups four internally identified vulnerabilities by CWE, one CVE per group: CVE-2026-76299 (CVSS 9.9, CWE-284 Improper Access Control), CVE-2026-76300 (8.8, CWE-664 Improper Control of a Resource Through its Lifetime), CVE-2026-76301 (7.6, CWE-693 Protection Mechanism Failure) and CVE-2026-76302 (9.9, CWE-707 Improper Neutralization). Affected: 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3; fixed in 9.4.16, 10.0.11, 10.2.8, 10.4.4. The hardening advisory does not publish CVSS vectors, authentication prerequisites or exploitation mechanics, so the precise attack paths of the two critical items are undisclosed.
SVD-2026-1007 (High, highest CVSS 8.8) covers twelve further Splunk Enterprise CVEs (CVE-2026-76287 to CVE-2026-76298), also fixed in the same releases (Splunk Secure Gateway fixes 3.10.12, 3.9.26, 3.8.73 for select CVEs). Notable items: CVE-2026-76293 (CVSS 7.2, CWE-94) remote code execution via Manager XML for users holding the edit_manager_xml capability; CVE-2026-76298 (8.8, CWE-321) hard-coded cryptographic key in the PostgreSQL sidecar letting a non-admin derive the sidecar superuser password and run OS commands; CVE-2026-76291 (8.8, CWE-284) schedule_search users bypassing SPL command safeguards; unauthenticated denial-of-service via a crafted Splunk Web Content-Type header (CVE-2026-76288, 7.5) and repeated unauthenticated Edge Processor package downloads (CVE-2026-76290, 7.5); a REST API lookup resource-exhaustion DoS (CVE-2026-76289, 6.5); plus authorization, SPL-injection and CSRF issues rated 4.2-6.5. SVD-2026-1009 (Critical) updates third-party packages (31 CVEs; Golang 1.26.3, gRPC, PostgreSQL, MongoDB, cryptography libraries).
For Splunk SOAR (all versions below 8.7.0, fixed in 8.7.0), SVD-2026-1011 (Critical) lists eight internally identified CVEs: CVE-2026-76531 (CVSS 9.9, CWE-552 Files or Directories Accessible to External Parties), CVE-2026-76407 (9.3, CWE-284), CVE-2026-76408 (8.8, CWE-664), CVE-2026-76526 (8.8, CWE-707), CVE-2026-76527 (5.5, CWE-703), CVE-2026-76528 (6.2, CWE-693), CVE-2026-76529 (7.5, CWE-424 Improper Protection of Alternate Path) and CVE-2026-76530 (8.8, CWE-647 non-canonical URL paths used for authorization decisions). SVD-2026-1010 (High) adds seven CVEs (CVE-2026-76303 to 76308, 76406; CVSS 4.3-7.5) covering stored XSS via app documentation, Automation Broker configuration disclosure, REST API query-filter and authentication-token disclosure, missing authorization and authentication-data decryption. SVD-2026-1012 updates 49 third-party package vulnerabilities (PostgreSQL 15.18, PyJWT 2.13.0, cryptography 48.0.1/49.0.0, Pillow 12.3.0). No workarounds are documented; upgrade is the only remediation.
SolarWinds published CVE-2026-28328 on 2026-10-20: a broken authorization schema in Observability Self-Hosted that lets low-privileged users access and modify information beyond their assigned permissions (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Versions 2026.2.3 and below are affected; 2026.4 fixes it. It was reported by three NATO security researchers (Dimitrios Titos, Georgios Sotiriadis, Frank Lycops). SecurityWeek also reports medium-severity XSS and SSRF issues in Observability Self-Hosted 2026.4 and an information disclosure issue in Patch Manager 2026.4; these have no CVE IDs in the sources reviewed.
No source reports in-the-wild exploitation, a public PoC, or CISA KEV listing for any of these CVEs. Because Splunk and SOAR concentrate security telemetry, credentials and automation playbooks, successful exploitation would be high-impact, so patching is prioritized by severity rather than by observed exploitation. Individual CVE-to-impact mapping for the grouped hardening CVEs is inferred only from their CWE classes; no exploit mechanics were disclosed.
MITRE ATT&CK techniques used in TL-2026-4136
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1552 Unsecured Credentials
Collection
T1213 Data from Information Repositories
Impact
Affected products and versions in Splunk Enterprise / Splunk SOAR and SolarWinds Security
- Splunk — Splunk Enterprise
Vulnerable versions: 9.4.0-9.4.15; 10.0.0-10.0.10; 10.2.0-10.2.7; 10.4.0-10.4.3
Fixed in: 9.4.16; 10.0.11; 10.2.8; 10.4.4 - Splunk — Splunk SOAR
Vulnerable versions: below 8.7.0
Fixed in: 8.7.0 - Splunk — Splunk Secure Gateway
Vulnerable versions: versions bundled with affected Splunk Enterprise (select CVEs)
Fixed in: 3.10.12; 3.9.26; 3.8.73 - SolarWinds — Observability Self-Hosted
Vulnerable versions: 2026.2.3 and below
Fixed in: 2026.4 - SolarWinds — Patch Manager
Vulnerable versions: versions prior to 2026.4
Fixed in: 2026.4
Remediation for Splunk Enterprise / Splunk SOAR and SolarWinds Security
Patches
- Splunk SVD-2026-1007, SVD-2026-1008, SVD-2026-1009 (Enterprise)
- Splunk SVD-2026-1010, SVD-2026-1011, SVD-2026-1012 (SOAR)
- SolarWinds CVE-2026-28328 advisory (Observability Self-Hosted 2026.4)
Immediate actions
- Upgrade Splunk Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4 (or higher)
- Upgrade Splunk SOAR to 8.7.0 or higher
- Upgrade SolarWinds Observability Self-Hosted to 2026.4 and Patch Manager to 2026.4
- Upgrade Splunk Secure Gateway to 3.10.12, 3.9.26 or 3.8.73 where applicable
Workarounds
- None documented by Splunk for the SOAR vulnerabilities; the Splunk hardening advisories provide upgrade as the only mitigation
Longer-term hardening
- Restrict network exposure of Splunk Web, management port, SOAR and Observability consoles to administrative networks
- Audit roles holding edit_manager_xml and schedule_search capabilities and apply least privilege
- Monitor Splunk _audit and SOAR logs for anomalous REST API, Manager XML and scheduled-search activity
CVEs associated with Splunk Enterprise / Splunk SOAR and SolarWinds Security
CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328
Weaknesses (CWE) in Splunk Enterprise / Splunk SOAR and SolarWinds Security
CWE-284, CWE-707, CWE-552, CWE-664, CWE-693, CWE-94, CWE-321
Timeline of Splunk Enterprise / Splunk SOAR and SolarWinds Security
- Splunk publishes the earlier August 2026 Splunk Enterprise security hardening release (SVD-2026-0801), fixed in 10.4.2/10.2.6/10.0.9/9.4.14 line.
- SolarWinds first publishes the CVE-2026-28328 advisory (CVSS 8.8) for Observability Self-Hosted 2026.2.3 and below; fixed in 2026.4.
- eSecurityPlanet reports three CVSS 9.9 flaws and two authenticated RCEs (CVE-2026-76293, CVE-2026-76298) across the Splunk release.
- Splunk publishes SVD-2026-1010, 1011 and 1012 for Splunk SOAR, fixed in 8.7.0, including CVE-2026-76531 (CVSS 9.9) and CVE-2026-76407 (CVSS 9.3).
- Splunk publishes SVD-2026-1007, 1008 and 1009 for Splunk Enterprise, fixed in 9.4.16, 10.0.11, 10.2.8 and 10.4.4.
- SecurityWeek reports the Splunk and SolarWinds updates, noting no exploitation or public PoC; Observability and Patch Manager 2026.4 also fix medium-severity XSS, SSRF and information disclosure issues.
Sources cited for Splunk Enterprise / Splunk SOAR and SolarWinds Security
- SecurityWeek: Splunk, SolarWinds Release Fresh Security Updates
- Splunk Security Advisories (index)
- SVD-2026-1008: Security Hardening in Splunk Enterprise - October 2026
- SVD-2026-1007: Security Vulnerabilities in Splunk Enterprise - October 2026
- SVD-2026-1011: Security Hardening in Splunk SOAR - October 2026
- SVD-2026-1010: Security Vulnerabilities in Splunk SOAR - October 2026
- SVD-2026-1006: Advance Notice of Publication of Splunk Security Advisories - October 2026
- SolarWinds CVE-2026-28328 Security Advisory
- SolarWinds Trust Center Security Advisories
- eSecurityPlanet: Splunk Patches Three Critical 9.9 Flaws and Two RCEs
- SecurityOnline: Splunk Fixes 31 Vulnerabilities in Enterprise and SOAR, Three Rated CVSS 9.9
- SecurityWeek: SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
Detection coverage for TL-2026-4136
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4136 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.