Splunk and SolarWinds Patch Multiple Security Flaws
Summary
Splunk and SolarWinds released updates fixing vulnerabilities across their products, including critical access-control and data-exposure flaws, remote code execution, denial-of-service, XSS, and SSRF issues.
Key points
- Splunk Enterprise versions 9.4.16, 10.0.11, 10.2.8, and 10.4.4 address 16 CVEs in the product code, including critical flaws CVE-2026-76299 and CVE-2026-76302.
- Splunk Enterprise updates also fix high-severity remote code execution, denial-of-service, authorization-bypass, and resource-control weaknesses.
- Splunk SOAR 8.7.0 patches 15 product-code vulnerabilities and more than a dozen issues in third-party libraries, including critical CVE-2026-76531 and CVE-2026-76407.
- SolarWinds fixed CVE-2026-28328, a high-severity broken-authorization issue in Observability that could let low-privileged users access restricted information.
- SolarWinds Observability updates address medium-severity XSS and SSRF flaws; Patch Manager updates fix a medium-severity information-disclosure bug.
- Observability Self-Hosted 2026.4 and Patch Manager 2026.4 include the SolarWinds fixes.
Article Details
- Vulnerability Types
- Improper access control
- Improper neutralization
- Remote code execution
- Denial of service
- Authorization bypass
- Improper resource control
- Data exposure
- Information disclosure
- Protection defects
- Broken authorization schema
- Cross-site scripting
- Server-side request forgery
- Severity
- Critical-severity, high-severity, and medium-severity vulnerabilities are reported.
- Affected Versions
- Splunk Enterprise 9.4.16
- Splunk Enterprise 10.0.11
- Splunk Enterprise 10.2.8
- Splunk Enterprise 10.4.4
- Splunk SOAR 8.7.0
- Observability Self-Hosted 2026.4
- Patch Manager 2026.4
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-28328Tracked as CVE-2026-28328, the flaw is described as a broken authorization schema issue.CVE-2026-7629910.0.11, 10.2.8, and 10.4.4 were rolled out with fixes for 16 CVEs in the product’s code, including CVE-2026-76299 and CVE-2026-76302, critical-severity improper access control and improper neutralization issues.CVE-2026-76302and 10.4.4 were rolled out with fixes for 16 CVEs in the product’s code, including CVE-2026-76299 and CVE-2026-76302, critical-severity improper access control and improper neutralization issues.CVE-2026-76407The most severe are CVE-2026-76531 and CVE-2026-76407, critical-severity data exposure and improper access control issues.CVE-2026-76531The most severe are CVE-2026-76531 and CVE-2026-76407, critical-severity data exposure and improper access control issues.
Vendors
SolarWindsSplunk and SolarWinds this week released patches for multiple vulnerabilities, including flaws leading to code execution, privilege escalation, denial-of-service (DoS), and information disclosure.SplunkSplunk and SolarWinds this week released patches for multiple vulnerabilities, including flaws leading to code execution, privilege escalation, denial-of-service (DoS), and information disclosure.
Products
ObservabilitySolarWinds released fixes for a high-severity bug in Observability that could allow low-privileged users to access restricted information.Observability Self-HostedObservability Self-Hosted version 2026.4 and Patch Manager version 2026.4 contain patches for these security defects.Patch ManagerAdditionally, the company released security updates that address medium-severity XSS and SSRF vulnerabilities in Observability, and a medium-severity information disclosure bug in Patch Manager.Splunk EnterpriseOn Wednesday, Splunk rolled out security updates for Splunk Enterprise and SOAR to resolve dozens of security defects, including multiple flaws in third-party packages.Splunk SOARSplunk SOAR version 8.7.0 was released with patches for 15 vulnerabilities in its code and over a dozen in third-party libraries.