Splunk and SolarWinds patch critical and high-severity flaws in Splunk Enterprise, Splunk SOAR, Observability and Patch Manager
Splunk and SolarWinds released security updates this week for vulnerabilities that allow code execution, privilege escalation, denial-of-service (DoS) and information disclosure. The article does not report exploitation in the wild. Splunk's updates cover Splunk Enterprise and Splunk SOAR, and SolarWinds fixed flaws in Observability and Patch Manager.
Entenda a falha
A vulnerabilidade
Splunk and SolarWinds patched many flaws. The most severe are four critical Splunk bugs. In Splunk Enterprise, CVE-2026-76299 is improper access control and CVE-2026-76302 is improper neutralization. In Splunk SOAR, CVE-2026-76531 is data exposure and CVE-2026-76407 is improper access control. Splunk Enterprise also got high-severity fixes for RCE, DoS, authorization bypass and improper resource control. Fixed versions are Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 and 10.4.4, and SOAR 8.7.0. SolarWinds Observability has CVE-2026-28328 (high), a broken authorization schema that lets low-privileged users reach restricted information, plus medium XSS and SSRF bugs. Patch Manager has a medium information disclosure bug. Both are fixed in 2026.4. The articles do not give the attacker prerequisites or the affected version ranges.
Como funciona
The articles do not describe how these flaws work step by step. The only mechanism given is for CVE-2026-28328: Observability's authorization schema is broken, so a request from a low-privileged user is not properly restricted and can reach information that should be off-limits. For the Splunk bugs, only the weakness classes are named, such as improper access control and improper neutralization, without the affected component or the point where processing fails.
Por que é vulnerável
The articles give no root-cause analysis. The weakness classes listed point to missing or wrong access checks (improper access control, broken authorization schema, authorization bypass), improper neutralization of input, and improper resource control. The articles do not say why these went unnoticed or what each patch changes in the code.
Como foi descoberta
The articles do not say who found the flaws or how they were reported. SecurityWeek reports that Splunk released the Enterprise and SOAR updates on Wednesday, and that SolarWinds released its fixes the same week. The story says the article does not report exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 08:16.
Detalhes técnicos
- Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 and 10.4.4 fix 16 CVEs in the product's own code. These include the critical-severity CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization). High-severity RCE, DoS, authorization bypass and improper resource control weaknesses were also addressed.
- Splunk SOAR 8.7.0 patches 15 vulnerabilities in its code and more than a dozen in third-party libraries. The most severe are the critical-severity CVE-2026-76531 (data exposure) and CVE-2026-76407 (improper access control). The release also fixes high-severity information disclosure, improper neutralization, improper resource control and protection defects.
- SolarWinds Observability has a high-severity broken authorization schema flaw, CVE-2026-28328, that lets low-privileged users access restricted information. Medium-severity XSS and SSRF bugs were also fixed in Observability.
- SolarWinds Patch Manager has a medium-severity information disclosure bug.
Remediação
- Upgrade Splunk Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4, depending on the release branch in use.
- Upgrade Splunk SOAR to 8.7.0.
- Upgrade SolarWinds Observability Self-Hosted and Patch Manager to 2026.4.
Linha do tempo
-
Splunk and SolarWinds patch critical and high-severity flaws in Splunk Enterprise, Splunk SOAR, Observability and Patch Manager
ler a análise desta fonte ocultar
Splunk and SolarWinds released security updates this week for vulnerabilities that allow code execution, privilege escalation, denial-of-service (DoS) and information disclosure. The article does not report exploitation in the wild. Splunk's updates cover Splunk Enterprise and Splunk SOAR, and SolarWinds fixed flaws in Observability and Patch Manager.
Technical Details
- Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 and 10.4.4 fix 16 CVEs in the product's own code. These include the critical-severity CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization). High-severity RCE, DoS, authorization bypass and improper resource control weaknesses were also addressed.
- Splunk SOAR 8.7.0 patches 15 vulnerabilities in its code and more than a dozen in third-party libraries. The most severe are the critical-severity CVE-2026-76531 (data exposure) and CVE-2026-76407 (improper access control). The release also fixes high-severity information disclosure, improper neutralization, improper resource control and protection defects.
- SolarWinds Observability has a high-severity broken authorization schema flaw, CVE-2026-28328, that lets low-privileged users access restricted information. Medium-severity XSS and SSRF bugs were also fixed in Observability.
- SolarWinds Patch Manager has a medium-severity information disclosure bug.
Remediation
- Upgrade Splunk Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4, depending on the release branch in use.
- Upgrade Splunk SOAR to 8.7.0.
- Upgrade SolarWinds Observability Self-Hosted and Patch Manager to 2026.4.