Splunk and SolarWinds ship security updates for critical and high-severity flaws
Splunk fixed 16 CVEs in Enterprise and 15 in SOAR, including critical access control and data exposure bugs, while SolarWinds patched a high-severity authorization flaw in Observability.
Splunk and SolarWinds both released security updates, addressing flaws that could allow code execution, privilege escalation, denial-of-service and information disclosure, SecurityWeek reported.
Splunk shipped Splunk Enterprise versions 9.4.16, 10.0.11, 10.2.8 and 10.4.4, fixing 16 CVEs in the product's own code. Two of them, CVE-2026-76299 and CVE-2026-76302, are described as critical-severity improper access control and improper neutralization issues. High-severity remote code execution, DoS, authorization bypass and improper resource control weaknesses were also addressed.
Splunk SOAR version 8.7.0 arrived with patches for 15 vulnerabilities in its code and more than a dozen in third-party libraries. The most severe are CVE-2026-76531 and CVE-2026-76407, described as critical-severity data exposure and improper access control issues. High-severity information disclosure, improper neutralization, improper resource control and protection defects were fixed as well.
SolarWinds fixed a high-severity broken authorization schema bug in Observability, tracked as CVE-2026-28328, that could let low-privileged users reach restricted information. It also patched medium-severity XSS and SSRF issues in Observability and an information disclosure bug in Patch Manager. Observability Self-Hosted 2026.4 and Patch Manager 2026.4 contain the fixes.
For defenders, the practical step is inventory: confirm which Splunk and SolarWinds versions you run, then move to the fixed releases. Both products sit close to logs and automation, so low-privileged access matters more than the labels suggest.
CVE references
Sources
- Splunk, SolarWinds Release Fresh Security UpdatesPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning