SE
Product
Splunk Enterprise
On CISA KEVExploited in the wild
203
CVEs
1
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 10High 64Medium 124Low 5
Watch
Add Splunk Enterprise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76278 | 4.3 | Oct 7 | Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76276 | 4.3 | Oct 7 | Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76275 | 4.3 | Oct 7 | Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76273 | 4.3 | Oct 7 | Improper Input Validation through the collect Command in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76272 | 4.3 | Oct 7 | Missing Access Control through the REST API in Splunk Secure Gateway Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76267 | 4.3 | Oct 7 | Log Injection through the REST API in Splunk App for Splunk O11y Cloud Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76264 | 4.3 | Oct 7 | Improper Authorization through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76309 | 4.3 | Aug 19 | Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76256 | 4.3 | Aug 19 | Information Exposure through REST API Endpoints in Splunk Secure Gateway Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-20203 | 4.3 | Apr 15 | Improper Access Control in Data Model Acceleration in Splunk Enterprise Affected: 10.2 before 10.2.2; 10.0 before 10.0.5; 9.4 before 9.4.10; 9.3 before 9.3.11 |
| CVE-2026-20139 | 4.3 | Feb 18 | Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.8; 9.3 before 9.3.9; 9.2 before 9.2.12 |
| CVE-2025-20383 | 4.3 | Dec 3 | Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app Affected: 10.0 before 10.0.2; 9.4 before 9.4.6; 9.3 before 9.3.8; 9.2 before 9.2.10 |
| CVE-2025-20322 | 4.3 | Jul 7 | Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2025-20323 | 4.3 | Jul 7 | Missing Access Control of Saved Searches in the Splunk Archiver app Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2025-20321 | 4.3 | Jul 7 | Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2025-20300 | 4.3 | Jul 7 | Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise Affected: 9.4 before 9.4.2; 9.3 before 9.3.5; 9.2 before 9.2.6; 9.1 before 9.1.9 |
| CVE-2025-20227 | 4.3 | Mar 26 | Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio Affected: 9.4 before 9.4.1; 9.3 before 9.3.3; 9.2 before 9.2.5; 9.1 before 9.1.8 |
| CVE-2024-53243 | 4.3 | Dec 10 | Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway Affected: 9.3 before 9.3.2; 9.2 before 9.2.4; 9.1 before 9.1.7 |
| CVE-2024-53245 | 4.3 | Dec 10 | Information Disclosure due to Username Collision with a Role that has the same Name as the User Affected: 9.2 before 9.2.4; 9.1 before 9.1.7 |
| CVE-2024-45734 | 4.3 | Oct 14 | Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard Affected: 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2024-45735 | 4.3 | Oct 14 | Improper Access Control for low-privileged user in Splunk Secure Gateway App Affected: 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2024-36989 | 4.3 | Jul 1 | Low-privileged user could create notifications in Splunk Web Bulletin Messages Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2026-76297 | 4.2 | Oct 21 | Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76277 | 4.1 | Oct 7 | Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |