1.0 Introduction
Recently, Splunk has released security updates to address multiple vulnerabilities in Splunk Enterprise. The most severe issue, CVE-2026-76268, is a missing authentication flaw in the Patroni REST API that lets an unauthenticated user with network access to a search head cluster member execute operating-system commands. It affects only the 10.4 and 10.2 versions.
2.0 Impact
Successful exploitation of these
vulnerabilities may allow a remote attacker to trigger remote code execution,
denial of service, sensitive information disclosure, elevation of privilege,
security restriction bypass and data manipulation on the targeted system. Most
of the other flaws are medium-rated and require a low-privileged authenticated
user. They include improper access control in the REST API and Splunk Secure
Gateway, SQL injection in the SPL2 module catalog, server-side request forgery
and a local privilege escalation during Linux package upgrades. This may lead
to execution of arbitrary code, unauthorised access to sensitive information
and system compromise.
3.0 Affected Products
?
Splunk Enterprise 10.4,
versions 10.4.0 to 10.4.2
?
Splunk Enterprise 10.2,
versions 10.2.0 to 10.2.6
?
Splunk Enterprise 10.0,
versions 10.0.0 to 10.0.9
?
Splunk Enterprise 9.4, versions
9.4.0 to 9.4.14
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following Splunk
security advisories and apply the necessary updates. Users are advised to
upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10 or 9.4.15, or
higher. Additional steps are required for CVE-2026-76264, CVE-2026-76265,
CVE-2026-76272 and CVE-2026-76280, including upgrading the Splunk Secure
Gateway app. If the PostgreSQL sidecar is not needed for Edge Processor, OpAmp
or SPL2 data pipelines, it can be turned off as a mitigation for
CVE-2026-76268.
Kindly refer to the following URL:
- https://advisory.splunk.com/advisories/SVD-2026-1001
- https://advisory.splunk.com/advisories/SVD-2026-1002
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References