Splunk patches 22 flaws, including critical unauthenticated RCE in Patroni API
Splunk released updates for Enterprise on October 7, 2026, fixing 22 vulnerabilities, including a CVSS 9.8 flaw allowing remote code execution.
Key points
- Splunk addressed 22 CVEs in two advisories published on October 7, 2026.
- The most severe issue, CVE-2026-76268, allows unauthenticated remote code execution.
- Fixes are available for versions 9.4, 10.0, 10.2, and 10.4 of Splunk Enterprise.
Splunk released patches for 22 vulnerabilities in Splunk Enterprise on October 7, 2026. According to The Cyber Express, the updates address flaws described in advisories SVD-2026-1001 and SVD-2026-1002, covering CVE identifiers from CVE-2026-76264 through CVE-2026-76285. The most severe vulnerability carries a CVSSv3.1 score of 9.8, representing a critical risk to affected systems.
A security bulletin issued on October 9, 2026, rated the overall risk as medium. The bulletin warned that remote attackers could exploit some of these flaws to achieve remote code execution, denial of service, or elevation of privilege. Other potential impacts include security restriction bypass, sensitive information disclosure, and data manipulation. These attacks require network access to the vulnerable components.
The Critical Patroni Flaw
The highest-rated issue is CVE-2026-76268, which stems from missing authentication in the Patroni REST API. This flaw is classified under CWE-306. On search head cluster members running versions below 10.4.3 or 10.2.7, an unauthenticated attacker with network access to the interface can run operating-system commands. Critical configuration operations on these systems require no login, enabling full remote code execution.
Affected Versions and Fixes
Splunk Enterprise versions 9.4.0 through 9.4.14 are affected, with the fix available in version 9.4.15. For the 10.0 branch, versions 10.0.0 to 10.0.9 are vulnerable, and the patch is in version 10.0.10. In the 10.2 branch, versions 10.2.0 to 10.2.6 require an update to 10.2.7. For the 10.4 branch, versions 10.4.0 to 10.4.2 must be updated to 10.4.3 to resolve these issues.
What should you do?
Administrators should immediately inventory their Splunk Enterprise environments to identify which versions are currently deployed. Users should prioritize updating search head clusters, as the critical Patroni flaw specifically targets these components. Network segmentation should be reviewed to limit access to the Patroni REST API interface. Organizations should apply the patched versions as soon as operational testing allows.
What to do and how to stay safe: Splunk
- Audit your Splunk Enterprise installations to confirm current version numbers against the affected ranges.
- Restrict network access to the Patroni REST API to prevent unauthenticated remote exploitation.
- Schedule immediate updates to the fixed versions for all affected Splunk Enterprise branches.
- Monitor system logs for signs of unauthorized command execution or privilege escalation attempts.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the highest CVSS score among the patched vulnerabilities?
The most severe vulnerability, CVE-2026-76268, has a CVSSv3.1 score of 9.8.
Which Splunk Enterprise versions are affected by the critical Patroni flaw?
Search head cluster members running versions below 10.4.3 or 10.2.7 are affected.
When were the security advisories for these patches published?
The advisories SVD-2026-1001 and SVD-2026-1002 were published on October 7, 2026.
