# Splunk Enterprise / Splunk SOAR and SolarWinds Security Updates (CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328)

> Splunk's October 2026 advisories fix critical (CVSS 9.9) access-control and neutralization flaws in Splunk Enterprise (9.4.16, 10.0.11, 10.2.8, 10.4.4) and a critical files-accessible flaw plus a 9.3 access-control flaw in Splunk SOAR (8.7.0). SolarWinds separately fixed a high-severity (CVSS 8.8) broken-authorization flaw, CVE-2026-28328, in Observability Self-Hosted 2026.4. No exploitation or public PoC is reported.

- **Published:** 2026-10-22T11:04:13Z
- **Last reviewed:** 2026-10-22T11:04:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4136
- **ID:** TL-2026-4136
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328

## Description

On 2026-10-21 Splunk published its October 2026 advisory set. For Splunk Enterprise, SVD-2026-1008 (Security Hardening) groups four internally identified vulnerabilities by CWE, one CVE per group: CVE-2026-76299 (CVSS 9.9, CWE-284 Improper Access Control), CVE-2026-76300 (8.8, CWE-664 Improper Control of a Resource Through its Lifetime), CVE-2026-76301 (7.6, CWE-693 Protection Mechanism Failure) and CVE-2026-76302 (9.9, CWE-707 Improper Neutralization). Affected: 9.4.0-9.4.15, 10.0.0-10.0.10, 10.2.0-10.2.7, 10.4.0-10.4.3; fixed in 9.4.16, 10.0.11, 10.2.8, 10.4.4. The hardening advisory does not publish CVSS vectors, authentication prerequisites or exploitation mechanics, so the precise attack paths of the two critical items are undisclosed.

SVD-2026-1007 (High, highest CVSS 8.8) covers twelve further Splunk Enterprise CVEs (CVE-2026-76287 to CVE-2026-76298), also fixed in the same releases (Splunk Secure Gateway fixes 3.10.12, 3.9.26, 3.8.73 for select CVEs). Notable items: CVE-2026-76293 (CVSS 7.2, CWE-94) remote code execution via Manager XML for users holding the edit_manager_xml capability; CVE-2026-76298 (8.8, CWE-321) hard-coded cryptographic key in the PostgreSQL sidecar letting a non-admin derive the sidecar superuser password and run OS commands; CVE-2026-76291 (8.8, CWE-284) schedule_search users bypassing SPL command safeguards; unauthenticated denial-of-service via a crafted Splunk Web Content-Type header (CVE-2026-76288, 7.5) and repeated unauthenticated Edge Processor package downloads (CVE-2026-76290, 7.5); a REST API lookup resource-exhaustion DoS (CVE-2026-76289, 6.5); plus authorization, SPL-injection and CSRF issues rated 4.2-6.5. SVD-2026-1009 (Critical) updates third-party packages (31 CVEs; Golang 1.26.3, gRPC, PostgreSQL, MongoDB, cryptography libraries).

For Splunk SOAR (all versions below 8.7.0, fixed in 8.7.0), SVD-2026-1011 (Critical) lists eight internally identified CVEs: CVE-2026-76531 (CVSS 9.9, CWE-552 Files or Directories Accessible to External Parties), CVE-2026-76407 (9.3, CWE-284), CVE-2026-76408 (8.8, CWE-664), CVE-2026-76526 (8.8, CWE-707), CVE-2026-76527 (5.5, CWE-703), CVE-2026-76528 (6.2, CWE-693), CVE-2026-76529 (7.5, CWE-424 Improper Protection of Alternate Path) and CVE-2026-76530 (8.8, CWE-647 non-canonical URL paths used for authorization decisions). SVD-2026-1010 (High) adds seven CVEs (CVE-2026-76303 to 76308, 76406; CVSS 4.3-7.5) covering stored XSS via app documentation, Automation Broker configuration disclosure, REST API query-filter and authentication-token disclosure, missing authorization and authentication-data decryption. SVD-2026-1012 updates 49 third-party package vulnerabilities (PostgreSQL 15.18, PyJWT 2.13.0, cryptography 48.0.1/49.0.0, Pillow 12.3.0). No workarounds are documented; upgrade is the only remediation.

SolarWinds published CVE-2026-28328 on 2026-10-20: a broken authorization schema in Observability Self-Hosted that lets low-privileged users access and modify information beyond their assigned permissions (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Versions 2026.2.3 and below are affected; 2026.4 fixes it. It was reported by three NATO security researchers (Dimitrios Titos, Georgios Sotiriadis, Frank Lycops). SecurityWeek also reports medium-severity XSS and SSRF issues in Observability Self-Hosted 2026.4 and an information disclosure issue in Patch Manager 2026.4; these have no CVE IDs in the sources reviewed.

No source reports in-the-wild exploitation, a public PoC, or CISA KEV listing for any of these CVEs. Because Splunk and SOAR concentrate security telemetry, credentials and automation playbooks, successful exploitation would be high-impact, so patching is prioritized by severity rather than by observed exploitation. Individual CVE-to-impact mapping for the grouped hardening CVEs is inferred only from their CWE classes; no exploit mechanics were disclosed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1565 Data Manipulation

## Sources

- [SecurityWeek: Splunk, SolarWinds Release Fresh Security Updates](https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/)
- [Splunk Security Advisories (index)](https://advisory.splunk.com/)
- [SVD-2026-1008: Security Hardening in Splunk Enterprise - October 2026](https://advisory.splunk.com/advisories/SVD-2026-1008)
- [SVD-2026-1007: Security Vulnerabilities in Splunk Enterprise - October 2026](https://advisory.splunk.com/advisories/SVD-2026-1007)
- [SVD-2026-1011: Security Hardening in Splunk SOAR - October 2026](https://advisory.splunk.com/advisories/SVD-2026-1011)
- [SVD-2026-1010: Security Vulnerabilities in Splunk SOAR - October 2026](https://advisory.splunk.com/advisories/SVD-2026-1010)
- [SVD-2026-1006: Advance Notice of Publication of Splunk Security Advisories - October 2026](https://advisory.splunk.com/advisories/SVD-2026-1006)
- [SolarWinds CVE-2026-28328 Security Advisory](https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28328)
- [SolarWinds Trust Center Security Advisories](https://www.solarwinds.com/trust-center/security-advisories)
- [eSecurityPlanet: Splunk Patches Three Critical 9.9 Flaws and Two RCEs](https://www.esecurityplanet.com/vulnerabilities/news-splunk-critical-vulnerabilities-october-2026/)
- [SecurityOnline: Splunk Fixes 31 Vulnerabilities in Enterprise and SOAR, Three Rated CVSS 9.9](https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/)
- [SecurityWeek: SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted](https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4136