CERT-FR flags multiple Splunk Enterprise and SOAR vulnerabilities enabling code execution, XSS and CSRF
CERT-FR published advisory CERTFR-2026-AVI-1366 on multiple vulnerabilities in Splunk products, based on Splunk security bulletins SVD-2026-1007 to SVD-2026-1012 released on 21 October 2026. Some of the flaws allow an attacker to achieve arbitrary code execution, breach data confidentiality, bypass the security policy and inject indirect remote code (XSS) or forge requests (CSRF). The advisory references more than 130 CVEs, many of them in third-party components, and does not report active exploitation. Splunk Enterprise and Splunk SOAR are affected.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1366 covers more than 130 CVEs in Splunk Enterprise and Splunk SOAR, many of them in third-party components. The impacts listed are arbitrary code execution, confidentiality breach, security policy bypass, XSS, CSRF and unspecified effects. The advisory does not map CVEs to impacts, give CVSS scores or state attacker requirements such as authentication or network reach, so a per-CVE ranking is not possible. Affected: Splunk Enterprise 10.0.x before 10.0.11, 10.2.x before 10.2.8, 10.4.x before 10.4.4, 9.4.x before 9.4.16, and Splunk SOAR before 8.7.0. Fixed versions are those or later.
Como funciona
The articles do not describe how any individual flaw is triggered, so the vulnerable process cannot be traced step by step. The advisory only lists impact categories (code execution, XSS, CSRF, policy bypass, confidentiality loss) without tying them to specific components or inputs. Details would have to come from the Splunk bulletins SVD-2026-1007 to SVD-2026-1012, which are not reproduced in the material available.
Por que é vulnerável
The articles do not state root causes for the individual CVEs. They only indicate that many of the CVEs sit in third-party components bundled with the Splunk products, and that the impact classes include XSS and CSRF. What the fixes change is not described beyond moving to the patched versions.
Como foi descoberta
Splunk published security bulletins SVD-2026-1007 to SVD-2026-1012 on 21 October 2026, and CERT-FR summarized them in advisory CERTFR-2026-AVI-1366 on 22 October 2026. The articles do not say who found the flaws or how they were reported. The advisory does not report active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:18.
Detalhes técnicos
- Affected: Splunk Enterprise 10.0.x before 10.0.11, 10.2.x before 10.2.8, 10.4.x before 10.4.4 and 9.4.x before 9.4.16; Splunk SOAR before 8.7.0.
- Impact categories listed: arbitrary code execution, confidentiality breach, security policy bypass, XSS, CSRF and unspecified impacts.
- The advisory does not map individual CVEs to specific impacts and gives no CVSS scores or exploitation details.
Remediação
- Apply the fixed versions described in the Splunk security bulletins SVD-2026-1007 through SVD-2026-1012, as CERT-FR directs.
- Fixed versions are implied to be 10.0.11, 10.2.8, 10.4.4, 9.4.16 and SOAR 8.7.0 or later.
Linha do tempo
-
CERT-FR flags multiple Splunk Enterprise and SOAR vulnerabilities enabling code execution, XSS and CSRF
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1366 on multiple vulnerabilities in Splunk products, based on Splunk security bulletins SVD-2026-1007 to SVD-2026-1012 released on 21 October 2026. Some of the flaws allow an attacker to achieve arbitrary code execution, breach data confidentiality, bypass the security policy and inject indirect remote code (XSS) or forge requests (CSRF). The advisory references more than 130 CVEs, many of them in third-party components, and does not report active exploitation. Splunk Enterprise and Splunk SOAR are affected.
Technical Details
- Affected: Splunk Enterprise 10.0.x before 10.0.11, 10.2.x before 10.2.8, 10.4.x before 10.4.4 and 9.4.x before 9.4.16; Splunk SOAR before 8.7.0.
- Impact categories listed: arbitrary code execution, confidentiality breach, security policy bypass, XSS, CSRF and unspecified impacts.
- The advisory does not map individual CVEs to specific impacts and gives no CVSS scores or exploitation details.
Remediation
- Apply the fixed versions described in the Splunk security bulletins SVD-2026-1007 through SVD-2026-1012, as CERT-FR directs.
- Fixed versions are implied to be 10.0.11, 10.2.8, 10.4.4, 9.4.16 and SOAR 8.7.0 or later.