# CERT-FR Flags Dozens of Splunk Flaws

Published: 2026-10-22 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/9e139303-f310-5cb7-8c11-9997fc3f8c7e/cert-fr-flags-dozens-of-splunk-flaws

> CERT-FR advisory lists over 100 vulnerabilities in Splunk Enterprise and Splunk SOAR enabling RCE, data exposure, XSS, CSRF and DoS; patches available.

CERT-FR has published an advisory consolidating multiple Splunk security bulletins (SVD-2026-1007 through SVD-2026-1012) covering a large batch of vulnerabilities affecting Splunk Enterprise versions prior to 10.0.11, 10.2.8, 10.4.4 and 9.4.16, as well as Splunk SOAR versions prior to 8.7.0. The flaws span a wide range of impact categories including arbitrary code execution, confidentiality breaches, security policy bypass, denial of service, reflected cross-site scripting (XSS), and cross-site request forgery (CSRF), with some issues unspecified by the vendor.

No evidence of active in-the-wild exploitation is cited in this bulletin; it is a routine vendor-coordinated disclosure consolidated by CERT-FR for French administrations and partners. Given the scale (over 100 CVEs referenced) and the presence of remote code execution among the possible impacts, organizations running affected Splunk Enterprise or Splunk SOAR deployments should prioritize patching to the fixed versions referenced in the official Splunk security bulletins. Defenders should treat Splunk instances as high-value targets given their role in security monitoring and should verify patch levels across all Enterprise and SOAR deployments.

No specific threat actor, malware, or campaign is associated with this disclosure; it is a vulnerability advisory requiring patch management action rather than active incident response.

## Mentioned in this report

- Vulnerabilities: CVE-2024-34062, CVE-2025-13465, CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2025-69277, CVE-2026-0994, CVE-2026-12143, CVE-2026-13149, CVE-2026-13676, CVE-2026-14257, CVE-2026-25541, CVE-2026-25679, CVE-2026-25990, CVE-2026-27137, CVE-2026-27140, CVE-2026-27141, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-34073, CVE-2026-39821, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39892, CVE-2026-40192, CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, CVE-2026-42311, CVE-2026-42508, CVE-2026-4539

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1366

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9e139303-f310-5cb7-8c11-9997fc3f8c7e/cert-fr-flags-dozens-of-splunk-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup