CERT-FR Flags Dozens of Splunk Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory lists over 100 vulnerabilities in Splunk Enterprise and Splunk SOAR enabling RCE, data exposure, XSS, CSRF and DoS; patches available.
CERT-FR has published an advisory consolidating multiple Splunk security bulletins (SVD-2026-1007 through SVD-2026-1012) covering a large batch of vulnerabilities affecting Splunk Enterprise versions prior to 10.0.11, 10.2.8, 10.4.4 and 9.4.16, as well as Splunk SOAR versions prior to 8.7.0. The flaws span a wide range of impact categories including arbitrary code execution, confidentiality breaches, security policy bypass, denial of service, reflected cross-site scripting (XSS), and cross-site request forgery (CSRF), with some issues unspecified by the vendor.
No evidence of active in-the-wild exploitation is cited in this bulletin; it is a routine vendor-coordinated disclosure consolidated by CERT-FR for French administrations and partners. Given the scale (over 100 CVEs referenced) and the presence of remote code execution among the possible impacts, organizations running affected Splunk Enterprise or Splunk SOAR deployments should prioritize patching to the fixed versions referenced in the official Splunk security bulletins. Defenders should treat Splunk instances as high-value targets given their role in security monitoring and should verify patch levels across all Enterprise and SOAR deployments.
No specific threat actor, malware, or campaign is associated with this disclosure; it is a vulnerability advisory requiring patch management action rather than active incident response.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1366
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,960 reports from 143 sources, 519 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs