Splunk has disclosed 46 vulnerabilities in its Splunk Enterprise log analysis platform, including multiple critical and high-severity issues that require immediate attention from administrators.
On 7 October 2026 the vendor released three security advisories covering 17 vulnerabilities in the core product and related applications, five internally identified security problems, and 24 issues in third-party packages.
The most severe finding, tracked as CVE-2026-76268, carries a CVSS v3.1 base score of 9.8 and is rated Critical. It affects the Patroni REST API used for PostgreSQL cluster management inside search head cluster deployments. Because of missing authentication checks, any network-accessible attacker can perform sensitive configuration operations and execute arbitrary operating system commands without credentials.
A second high-severity vulnerability, CVE-2026-76266, was also published. Rated High with a CVSS base score of 7.7, the flaw stems from insufficient privilege handling during package updates on Linux. Under certain conditions it allows an attacker to escalate privileges and run operating system commands as root.
Splunk has made patches available for the affected versions and strongly recommends that customers upgrade without delay. The company continues to monitor for any signs of in-the-wild exploitation of the disclosed issues.
