# Splunk Patches Dozens of Vulnerabilities

Published: 2026-10-08 · Severity: routine
Canonical: https://vorant.io/reports/26242451-8b56-5887-be84-21a644c58148/splunk-patches-dozens-of-vulnerabilities

> CERT-FR advisory details over 80 Splunk CVEs including RCE, privilege escalation, SSRF, SQLi and data exposure; no active exploitation reported.

CERT-FR has published an advisory (CERTFR-2026-AVI-1281) relaying Splunk's own security bulletins (SVD-2026-1001 through 1005, dated 07 October 2026) that disclose a large batch of vulnerabilities across several Splunk products. Affected software includes Splunk Enterprise (versions 9.4.x before 9.4.15, 10.0.x before 10.0.10, 10.2.x before 10.2.7, and 10.4.x before 10.4.3), the Splunk Add-on for Amazon Web Services (8.2.x before 8.2.2), and the Splunk MCP Server (1.2.x before 1.2.1).

The vulnerabilities span a wide range of impact categories: remote code execution, privilege escalation, confidentiality breaches, denial of service, server-side request forgery (SSRF), SQL injection, and security-policy bypass. Given the breadth of the advisory (over 80 distinct CVE identifiers referenced), the most severe classes — remote code execution and privilege escalation — pose the greatest operational risk to organizations running affected Splunk deployments, particularly if Splunk instances are internet-facing or process untrusted data inputs.

No in-the-wild exploitation is noted in the advisory. CERT-FR's guidance is standard: administrators should consult Splunk's official security bulletins for the full technical details and apply the vendor-supplied patches/upgrades to bring Enterprise, the AWS Add-on, and the MCP Server to the fixed versions as soon as feasible, prioritizing systems exposed to untrusted networks or data.

## Mentioned in this report

- Vulnerabilities: CVE-2025-22870, CVE-2025-22872, CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-26007, CVE-2026-27136, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-34073, CVE-2026-34180, CVE-2026-34986, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39836

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1281

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/26242451-8b56-5887-be84-21a644c58148/splunk-patches-dozens-of-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup