Splunk Patches Dozens of Vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory details over 80 Splunk CVEs including RCE, privilege escalation, SSRF, SQLi and data exposure; no active exploitation reported.
CERT-FR has published an advisory (CERTFR-2026-AVI-1281) relaying Splunk's own security bulletins (SVD-2026-1001 through 1005, dated 07 October 2026) that disclose a large batch of vulnerabilities across several Splunk products. Affected software includes Splunk Enterprise (versions 9.4.x before 9.4.15, 10.0.x before 10.0.10, 10.2.x before 10.2.7, and 10.4.x before 10.4.3), the Splunk Add-on for Amazon Web Services (8.2.x before 8.2.2), and the Splunk MCP Server (1.2.x before 1.2.1).
The vulnerabilities span a wide range of impact categories: remote code execution, privilege escalation, confidentiality breaches, denial of service, server-side request forgery (SSRF), SQL injection, and security-policy bypass. Given the breadth of the advisory (over 80 distinct CVE identifiers referenced), the most severe classes — remote code execution and privilege escalation — pose the greatest operational risk to organizations running affected Splunk deployments, particularly if Splunk instances are internet-facing or process untrusted data inputs.
No in-the-wild exploitation is noted in the advisory. CERT-FR's guidance is standard: administrators should consult Splunk's official security bulletins for the full technical details and apply the vendor-supplied patches/upgrades to bring Enterprise, the AWS Add-on, and the MCP Server to the fixed versions as soon as feasible, prioritizing systems exposed to untrusted networks or data.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1281
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs