Tia N.List

Reported by 4 outlets

Splunk patches 17 CVEs including critical CVE-2026-76268 (CVSS 9.1) unauthenticated RCE

new0.2
Why this score
Breadth
2.00 / 2.0 · 4 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
4.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.22 / 0.6 · time to second source
Recency
× 0.02 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.2 / 10 = base × recency + community
threataft.comadvisory.splunk.comgbhackers.cominsomnisec.com CVE-2026-76268 desk first seen 5d ago

Desk analysis

Splunk released fixes for 17 CVEs in Splunk Enterprise, with CVE-2026-76268 rated CVSS 9.8 by the vendor advisory SVD-2026-1001 (disclosed October 7, 2026) and 9.1 in ThreatAft's reporting. The critical flaw affects versions below 10.4.3 and 10.2.7 (10.0.x and 9.4.x are not affected) and is a missing-authentication vulnerability in the Patroni REST API on a search head cluster member, allowing an unauthenticated attacker with network access to execute arbitrary operating-system commands. The advisory assigns CWE-306 and notes the interface does not require authentication for critical configuration operations.

The exposure is severe for any organization running Splunk Enterprise search head clusters with the Patroni REST API reachable from untrusted networks, because exploitation requires no credentials and yields full OS-level control. The event list shows the story scored 5.0 with a severity component of 1.0 and velocity of 1.0, which aligns with the high-impact, unauthenticated nature of the bug. This is not another routine patch cycle; it is a direct remote-code-execution path into SIEM infrastructure that holds security telemetry, making it more dangerous than lower-severity authorization or SQL-injection issues in the same batch (such as CVE-2026-76270 at CVSS 6.5).

Defenders should upgrade to Splunk Enterprise 10.4.3, 10.2.7, 10.0.10, or 9.4.15; for CVE-2026-76268 specifically, patch to 10.4.3 or 10.2.7. If upgrading is impossible immediately, turn off the PostgreSQL sidecar by setting disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf and restart Splunk Enterprise, provided Edge Processor, OpAmp, or SPL2 data pipelines are not in use. Network-level containment should restrict access to the Patroni REST API port on search head cluster members; hunt for unauthorized access attempts against that endpoint and audit any unexpected server.conf modifications.

Watch for confirmation of active exploitation in the wild, because the vendor advisory already lists the flaw as critical with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and GBHackers reported it as a vulnerability that allows unauthenticated attackers to execute OS commands. Any appearance of CVE-2026-76268 on CISA KEV or GreyNoise telemetry should trigger an emergency response rather than a standard patch window.

Timeline

  1. original reporting

    Splunk patched 17 CVEs yesterday. The one that matters most: CVE-2026-76268 (CVSS 9.1) — unauthenticated RCE via the Patroni REST API on sea

    threataft.com · 5d ago · October 8th, 2026

    Splunk patched 17 CVEs yesterday. The one that matters most: CVE-2026-76268 (CVSS 9.1) — unauthenticated RCE via the Patroni REST API on sea

    via Mastodon https://threataft.com/articles/splunk-mass-disclosure-cve-2026-76268-patroni-rce

  2. update from advisory.splunk.com

    Splunk Advisory SVD-2026-1001 — CVE-2026-76268 (CVSS 9.8)

    advisory.splunk.com · 7d ago · October 7th, 2026

    The official Splunk advisory (SVD-2026-1001) published on October 7, 2026, documents CVE-2026-76268 with a CVSS v3.1 score of 9.8 (Critical). It confirms unauthenticated OS command execution through the Patroni REST API on Splunk Enterprise search head cluster members, affecting versions below 10.4.3 and 10.2.7 (10.0.x and 9.4.x not affected). Mitigations include disabling the PostgreSQL sidecar by setting [postgres] disabled = true in server.conf.

  3. update from threataft.com

    Splunk 17 CVEs — CVSS 9.1 Patroni RCE, Enterprise SIEM | ThreatAft

    threataft.com · 6d ago · October 8th, 2026

    The article recommends patching Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, or 9.4.15. It notes the advisory disclosure and covers CWE-306 and CWE-284 among the flaws.

  4. update from gbhackers.com

    Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

    gbhackers.com · 5d ago · October 8th, 2026

    Splunk has addressed a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to execute operating system commands through the Patroni REST API on a search head cluster member. This issue, tracked as CVE-2026-76268, has a CVSS v3.1 score of 9.8 and was disclosed in advisory SVD-2026-1001 on October 7, 2026. Successful exploitation requires network […] The post Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

  5. mentioned by gbhackers.com

    Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands — GBHackers

    gbhackers.com · 5d ago · October 8th, 2026

  6. update from gbhackers.com

    Critical Splunk Enterprise vulnerability allows unauthenticated remote OS command execution

    gbhackers.com · 5d ago · October 8th, 2026

    This type of unauthenticated RCE exposes Splunk instances to full compromise and requires immediate patching.

  7. update from insomnisec.com

    Critical Splunk Enterprise Flaw Lets Attackers Run Commands on Search Head Clusters Without a Login If your security team relies on Splunk E

    insomnisec.com · 1d ago · October 12th, 2026

    Critical Splunk Enterprise Flaw Lets Attackers Run Commands on Search Head Clusters Without a Login If your security team relies on Splunk E

    via Mastodon https://insomnisec.com/posts/2026-10-12-splunk-enterprise-cve-2026-76268-patroni-rce_insomnisec_v3/

Covered in

digest 2026-10-08

Source on GitHub