{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Splunk Enterprise: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/splunk--splunk-enterprise/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/splunk--splunk-enterprise/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76302/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76302/",
   "title": "CVE-2026-76302 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.",
   "date_published": "2026-10-21T22:52:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76301/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76301/",
   "title": "CVE-2026-76301 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76301 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.",
   "date_published": "2026-10-21T22:52:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76300/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76300/",
   "title": "CVE-2026-76300 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.",
   "date_published": "2026-10-21T22:52:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76299/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76299/",
   "title": "CVE-2026-76299 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.",
   "date_published": "2026-10-21T22:52:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76298/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76298/",
   "title": "CVE-2026-76298 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the \"admin\" or \"power\" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.\nThe vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.",
   "date_published": "2026-10-21T22:52:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76297/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76297/",
   "title": "CVE-2026-76297 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets.\nThe vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider state.\nThe vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.\nFor more information see Run federated searches over remote Splunk platform deployments (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76296/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76296/",
   "title": "CVE-2026-76296 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.\nThe vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.\nFor more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76295/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76295/",
   "title": "CVE-2026-76295 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the \"admin\" or \"power\" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access.\nThe vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76294/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76294/",
   "title": "CVE-2026-76294 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.\nThe vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.\nFor more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76293/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76293/",
   "title": "CVE-2026-76293 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.",
   "date_published": "2026-10-21T22:51:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76292/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76292/",
   "title": "CVE-2026-76292 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the \"admin\" Splunk role or the \"sc_admin\" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints.\nThe vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.\nFor more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76291/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76291/",
   "title": "CVE-2026-76291 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.\nThe vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.\nFor more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.\nFor more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76290/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76290/",
   "title": "CVE-2026-76290 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.\nThe vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.\nAfter upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).",
   "date_published": "2026-10-21T22:51:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76289/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76289/",
   "title": "CVE-2026-76289 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service.\nThe vulnerability is possible because the endpoint does not limit resource use when it processes response field selections.\nFor more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76288/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76288/",
   "title": "CVE-2026-76288 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.",
   "date_published": "2026-10-21T22:51:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76287/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76287/",
   "title": "CVE-2026-76287 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope.\nThe vulnerability is possible because the Data Management Representational State Transfer (REST) API verifies the required capability but does not verify that the requested preview job belongs to the requester.\nThe affected Data Management REST API is available only when the Edge Processor feature is turned on. The Edge Processor feature is turned off by default.\nFor more information see Set up a data management control plane (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/getting-started/set-up-a-data-management-control-plane) and Getting sample data for previewing data transformations (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/working-with-pipelines/getting-sample-data-for-previewing-data-transformations) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76285/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76285/",
   "title": "CVE-2026-76285 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76285 are related to improper adherence to coding standards and are grouped under the Common Weakness Enumeration (CWE) CWE-710.",
   "date_published": "2026-10-07T20:46:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76284/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76284/",
   "title": "CVE-2026-76284 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76284 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.",
   "date_published": "2026-10-07T20:46:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76283/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76283/",
   "title": "CVE-2026-76283 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76283 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.",
   "date_published": "2026-10-07T20:46:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76282/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76282/",
   "title": "CVE-2026-76282 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76282 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.",
   "date_published": "2026-10-07T20:46:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76281/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76281/",
   "title": "CVE-2026-76281 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76281 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.",
   "date_published": "2026-10-07T20:46:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76280/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76280/",
   "title": "CVE-2026-76280 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the \"admin\" or \"sc_admin\" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use. The vulnerability is possible because the affected collections allow unrestricted write access instead of limiting writes to authorized Splunk Secure Gateway workflows. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store), KV store endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/kv-store-endpoints/kv-store-endpoint-descriptions), and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.",
   "date_published": "2026-10-07T20:46:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76279/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76279/",
   "title": "CVE-2026-76279 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works) in the Splunk documentation.",
   "date_published": "2026-10-07T20:46:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76278/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76278/",
   "title": "CVE-2026-76278 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view. The vulnerability is possible because Splunk Enterprise does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants. For more information see Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) and Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) in the Splunk documentation.\n\nSplunk Enterprise versions 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76277/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76277/",
   "title": "CVE-2026-76277 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.",
   "date_published": "2026-10-07T20:46:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76276/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76276/",
   "title": "CVE-2026-76276 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production JavaScript bundles for the app contain embedded source maps that include original source code. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and Navigating Splunk Web (https://help.splunk.com/en/splunk-enterprise/search/search-tutorial/10.4/part-1-getting-started/navigating-splunk-web) in the Splunk documentation.\n\nSplunk Enterprise versions 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76275/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76275/",
   "title": "CVE-2026-76275 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.",
   "date_published": "2026-10-07T20:46:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76274/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76274/",
   "title": "CVE-2026-76274 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token. The vulnerability is possible because Splunk App for Splunk Observability Cloud does not fully validate the destination of an outbound request. For more information see Authentication tokens (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens) in the Splunk documentation.\n\nSplunk Enterprise versions 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76273/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76273/",
   "title": "CVE-2026-76273 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.",
   "date_published": "2026-10-07T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76272/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76272/",
   "title": "CVE-2026-76272 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.",
   "date_published": "2026-10-07T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76271/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76271/",
   "title": "CVE-2026-76271 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is possible because the app uses an inefficient regular expression to validate input submitted through the endpoint. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and restmap.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/restmap.conf) in the Splunk documentation.\n\nSplunk Enterprise versions 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76270/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76270/",
   "title": "CVE-2026-76270 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other users. The vulnerability is possible because Splunk Enterprise and Splunk Cloud Platform do not parameterize user-supplied values before using them in database queries for SPL2 module filtering. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation.\n\nSplunk Enterprise versions 10.2.x, 10.0.x, and 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76269/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76269/",
   "title": "CVE-2026-76269 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.",
   "date_published": "2026-10-07T20:46:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76268/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76268/",
   "title": "CVE-2026-76268 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76267/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76267/",
   "title": "CVE-2026-76267 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log.\n\nSplunk Enterprise versions 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76266/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76266/",
   "title": "CVE-2026-76266 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.",
   "date_published": "2026-10-07T20:46:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76265/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76265/",
   "title": "CVE-2026-76265 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the \"admin\" or \"power\" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.",
   "date_published": "2026-10-07T20:46:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76264/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76264/",
   "title": "CVE-2026-76264 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.",
   "date_published": "2026-10-07T20:46:28Z"
  }
 ]
}