Multiple Vulnerabilities Discovered in Splunk Products

Multiple Vulnerabilities Discovered in Splunk Products

First seen 20 Aug 2026, 19:58 UTC •advisory.splunk.comFeedlywww.incibe.esvuldb.comportal.auscert.org.au •87% similarity •57.8

Article Content

Browse articles
ThreatCluster

Splunk has addressed several vulnerabilities affecting its Enterprise and SOAR products. CVE-2026-76338 and CVE-2026-76352 allow unauthorized access to Splunk Observability Cloud data and potential system integrity issues via XSS attacks. Additionally, CVE-2026-76364, a SQL injection vulnerability in Splunk SOAR, enables authenticated users to execute arbitrary SQL commands. Affected versions include Splunk Enterprise versions below 10.4.2 and Splunk SOAR versions below 8.6.0. Users are advised to upgrade to the latest versions and restrict access to sensitive roles. The vulnerabilities were published on August 19, 2026, with no evidence of active exploitation reported yet.

Key Points: • CVE-2026-76338 allows unauthorized access to Splunk Observability Cloud data. • CVE-2026-76364 enables SQL injection attacks for authenticated users in Splunk SOAR. • Users should upgrade to the latest Splunk versions and restrict sensitive role access.

ThreatCluster AI How this analysis works

Timeline

2026-08-19
CVE-2026-76338 published
Splunk disclosed a vulnerability allowing unauthorized access to Observability Cloud data for non-admin users.
advisory.splunk.com
2026-08-19
CVE-2026-76364 published
A SQL injection vulnerability was disclosed in Splunk SOAR, affecting versions below 8.6.0.
Feedly
2026-08-20
Splunk releases advisory
Splunk advised users to upgrade to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 or higher to mitigate vulnerabilities.
advisory.splunk.com

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Splunk Automation Broker CyberArk REST Server Splunk App For Splunk Observability Cloud Splunk Observability Cloud Splunk Secure Gateway