{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Splunk Enterprise: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/splunk--splunk-enterprise/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/splunk--splunk-enterprise/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76302/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76302/",
   "title": "CVE-2026-76302 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.",
   "date_published": "2026-10-21T22:52:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76299/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76299/",
   "title": "CVE-2026-76299 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.",
   "date_published": "2026-10-21T22:52:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76298/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76298/",
   "title": "CVE-2026-76298 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the \"admin\" or \"power\" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.\nThe vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.",
   "date_published": "2026-10-21T22:52:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76293/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76293/",
   "title": "CVE-2026-76293 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.",
   "date_published": "2026-10-21T22:51:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76291/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76291/",
   "title": "CVE-2026-76291 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.\nThe vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.\nFor more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.\nFor more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.",
   "date_published": "2026-10-21T22:51:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76290/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76290/",
   "title": "CVE-2026-76290 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.\nThe vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.\nAfter upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).",
   "date_published": "2026-10-21T22:51:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76288/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76288/",
   "title": "CVE-2026-76288 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.",
   "date_published": "2026-10-21T22:51:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76285/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76285/",
   "title": "CVE-2026-76285 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76285 are related to improper adherence to coding standards and are grouped under the Common Weakness Enumeration (CWE) CWE-710.",
   "date_published": "2026-10-07T20:46:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76284/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76284/",
   "title": "CVE-2026-76284 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76284 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.",
   "date_published": "2026-10-07T20:46:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76283/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76283/",
   "title": "CVE-2026-76283 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76283 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.",
   "date_published": "2026-10-07T20:46:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76282/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76282/",
   "title": "CVE-2026-76282 disclosed",
   "content_text": "As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76282 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.",
   "date_published": "2026-10-07T20:46:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76268/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76268/",
   "title": "CVE-2026-76268 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected.",
   "date_published": "2026-10-07T20:46:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76266/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76266/",
   "title": "CVE-2026-76266 disclosed",
   "content_text": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.",
   "date_published": "2026-10-07T20:46:29Z"
  }
 ]
}