SE
Product
Splunk Enterprise
On CISA KEVExploited in the wild
237
CVEs
1
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 10High 78Medium 142Low 7
Watch
Add Splunk Enterprise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76344 | 7.7 | Aug 19 | Path Traversal through the Search Dispatch REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76283 | 7.6 | Oct 7 | Protection Mechanism Failure in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-20252 | 7.6 | Jun 10 | Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise Affected: 10.2 before 10.2.4; 10.0 before 10.0.7; 9.4 before 9.4.12; 9.3 before 9.3.13 |
| CVE-2026-76290 | 7.5 | Oct 21 | Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11 |
| CVE-2026-76288 | 7.5 | Oct 21 | Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76355 | 7.5 | Aug 19 | Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise Affected: 10.4 before 10.4.2 |
| CVE-2026-76262 | 7.5 | Aug 19 | Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2 |
| CVE-2024-53246 | 7.5 | Dec 10 | Sensitive Information Disclosure through SPL commands Affected: 9.3 before 9.3.2; 9.2 before 9.2.4; 9.1 before 9.1.7 |
| CVE-2024-36982 | 7.5 | Jul 1 | Denial of Service through null pointer reference in “cluster/config” REST endpoint Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2024-36991 | 7.5 | Jul 1 | Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2023-40593 | 7.5 | Aug 30 | Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request Affected: 8.2 before 8.2.12; 9.0 before 9.0.6 |
| CVE-2023-40594 | 7.5 | Aug 30 | Denial of Service (DoS) via the ‘printf’ Search Function Affected: 8.2 before 8.2.12; 9.0 before 9.0.6; 9.1 before 9.1.1 |
| CVE-2023-22941 | 7.5 | Feb 14 | Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon Affected: 8.1 before 8.1.13; 8.2 before 8.2.10; 9.0 before 9.0.4 |
| CVE-2026-76325 | 7.3 | Aug 19 | Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76323 | 7.3 | Aug 19 | SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76321 | 7.3 | Aug 19 | SPL Injection through Nearby Event Searches in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76255 | 7.3 | Aug 19 | Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise Affected: 10.4 before 10.4.1; 10.2 before 10.2.6; 10.0 before 10.0.8; 9.4 before 9.4.13 |
| CVE-2025-20320 | 7.3 | Jul 7 | Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2026-76293 | 7.2 | Oct 21 | Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-20297 | 7.2 | Jul 15 | Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise Affected: 10.4 before 10.4.1; 10.2 before 10.2.5; 10.0 before 10.0.8; 9.4 before 9.4.13; 9.3 before 9.3.14 |
| CVE-2026-20163 | 7.2 | Mar 11 | Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise Affected: 10.0 before 10.0.4; 9.4 before 9.4.9; 9.3 before 9.3.10 |
| CVE-2024-29945 | 7.2 | Mar 27 | Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise Affected: 9.2 before 9.2.1; 9.1 before 9.1.4; 9.0 before 9.0.9 |
| CVE-2026-76336 | 7.1 | Aug 19 | Improper Access Control through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6 |
| CVE-2026-76333 | 7.1 | Aug 19 | Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76332 | 7.1 | Aug 19 | SPL Injection through Splunk Web in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76330 | 7.1 | Aug 19 | SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76251 | 7.1 | Aug 19 | Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9 |
| CVE-2026-20204 | 7.1 | Apr 15 | Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise Affected: 10.2 before 10.2.1; 10.0 before 10.0.5; 9.4 before 9.4.10; 9.3 before 9.3.11 |