# CERT-FR flags over 100 Splunk CVEs

Published: 2026-10-22 · Severity: routine
Canonical: https://vorant.io/reports/20c1250d-0807-5a3a-8914-8392affa2cad/cert-fr-flags-over-100-splunk-cves

> CERT-FR advisory covers 100+ vulnerabilities in Splunk Enterprise and SOAR enabling RCE, data exposure, XSS, CSRF and DoS; patch now.

CERT-FR has published an advisory consolidating more than one hundred vulnerabilities affecting Splunk Enterprise (versions 10.0.x prior to 10.0.11, 10.2.x prior to 10.2.8, 10.4.x prior to 10.4.4, and 9.4.x prior to 9.4.16) and Splunk SOAR (versions prior to 8.7.0). The vulnerabilities, disclosed across six Splunk security bulletins (SVD-2026-1007 through SVD-2026-1012) dated 21 October 2026, span a wide range of impacts including arbitrary code execution, confidentiality breaches, security policy bypass, denial of service, reflected/stored cross-site scripting (XSS), and cross-site request forgery (CSRF).

No evidence of in-the-wild exploitation is cited in the advisory; this is a routine vendor patch cycle being relayed by the French national CERT. Given the volume and the inclusion of arbitrary code execution vectors in widely deployed SIEM and SOAR infrastructure, defenders running affected Splunk versions should prioritize patching, as Splunk deployments are often high-value targets due to the sensitive log and security data they aggregate.

Defenders should consult the referenced Splunk security bulletins for per-CVE technical detail and apply the vendor-supplied fixed versions (Splunk Enterprise 10.0.11, 10.2.8, 10.4.4, 9.4.16, and Splunk SOAR 8.7.0 or later) as soon as feasible. No specific detection guidance or IOCs were provided by CERT-FR or Splunk in this bulletin.

## Mentioned in this report

- Vulnerabilities: CVE-2024-34062, CVE-2025-13465, CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2025-69277, CVE-2026-0994, CVE-2026-12143, CVE-2026-13149, CVE-2026-13676, CVE-2026-14257, CVE-2026-25541, CVE-2026-25679, CVE-2026-25990, CVE-2026-27137, CVE-2026-27140, CVE-2026-27141, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-34073, CVE-2026-39821, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39892, CVE-2026-40192, CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, CVE-2026-42311, CVE-2026-42508, CVE-2026-4539

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1366

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/20c1250d-0807-5a3a-8914-8392affa2cad/cert-fr-flags-over-100-splunk-cves.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup