CERT-FR flags over 100 Splunk CVEs
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory covers 100+ vulnerabilities in Splunk Enterprise and SOAR enabling RCE, data exposure, XSS, CSRF and DoS; patch now.
CERT-FR has published an advisory consolidating more than one hundred vulnerabilities affecting Splunk Enterprise (versions 10.0.x prior to 10.0.11, 10.2.x prior to 10.2.8, 10.4.x prior to 10.4.4, and 9.4.x prior to 9.4.16) and Splunk SOAR (versions prior to 8.7.0). The vulnerabilities, disclosed across six Splunk security bulletins (SVD-2026-1007 through SVD-2026-1012) dated 21 October 2026, span a wide range of impacts including arbitrary code execution, confidentiality breaches, security policy bypass, denial of service, reflected/stored cross-site scripting (XSS), and cross-site request forgery (CSRF).
No evidence of in-the-wild exploitation is cited in the advisory; this is a routine vendor patch cycle being relayed by the French national CERT. Given the volume and the inclusion of arbitrary code execution vectors in widely deployed SIEM and SOAR infrastructure, defenders running affected Splunk versions should prioritize patching, as Splunk deployments are often high-value targets due to the sensitive log and security data they aggregate.
Defenders should consult the referenced Splunk security bulletins for per-CVE technical detail and apply the vendor-supplied fixed versions (Splunk Enterprise 10.0.11, 10.2.8, 10.4.4, 9.4.16, and Splunk SOAR 8.7.0 or later) as soon as feasible. No specific detection guidance or IOCs were provided by CERT-FR or Splunk in this bulletin.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1366
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs