# NCSC-NL flags 30+ Splunk Enterprise flaws

Published: 2026-10-28 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/c5150286-80ab-5191-90a3-e940116fd063/ncsc-nl-flags-30-splunk-enterprise-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> NCSC-NL advisory details over 30 vulnerabilities in Splunk Enterprise versions before 10.4.4, including several critical-severity authorization and injection bugs; patches available.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0457.html

## What to check

- Applies to: The 31 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL published an advisory (NCSC-2026-0457) summarizing a large batch of vulnerabilities fixed by Splunk in Splunk Enterprise versions prior to 10.4.4 (and some other specific versions). The issues span a wide range of weakness classes including improper authentication in the Data Management REST API, insufficient request-header limits enabling DoS via the JavaScript logger endpoint, REST API abuse for lookup table files causing DoS, insufficient access control on the Edge Processor package download endpoint, execution of dangerous SPL commands by users with schedule_search capability, exposure of mobile alert notification data via the App Key Value Store REST API, arbitrary OS command execution through Splunk Web Manager XML configuration, unauthorized movement of field extractions/transformations, filter-restriction bypass, unauthorized sourcetype renaming changes, phishing-enabled disabling of federated search providers, and derivation of the PostgreSQL sidecar database superuser password via exposure in search job logs.

## Mentioned in this report

- Vulnerabilities: CVE-2026-76287, CVE-2026-76288, CVE-2026-76289, CVE-2026-76290, CVE-2026-76291, CVE-2026-76292, CVE-2026-76293, CVE-2026-76294, CVE-2026-76295, CVE-2026-76296, CVE-2026-76297, CVE-2026-76298, CVE-2026-76299, CVE-2026-76300, CVE-2026-76301, CVE-2026-76302, CVE-2026-76303, CVE-2026-76304, CVE-2026-76305, CVE-2026-76306, CVE-2026-76307, CVE-2026-76308, CVE-2026-76406, CVE-2026-76407, CVE-2026-76408, CVE-2026-76526, CVE-2026-76527, CVE-2026-76528, CVE-2026-76529, CVE-2026-76530, CVE-2026-76531

## Detection guidance (public sample)

### Splunk Daemon Spawning Shell With Recon or Download Commands (Windows)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

splunkd.exe spawning a shell or LOLBin with discovery, download or encoded-payload arguments, consistent with OS command execution after exploiting Splunk Enterprise flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunk Daemon Spawning Shell With Recon or Download Commands (Windows)
id: 869f2d2f-29a9-548d-b573-7126ed708b3d
status: experimental
description: Detects splunkd.exe spawning command interpreters or LOLBins with discovery,
  download or encoded-payload arguments. Generalises the arbitrary OS command execution
  risk described for Splunk Enterprise (e.g. via Splunk Web Manager XML configuration
  or dangerous SPL commands); no exploit-specific strings are used.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \splunkd.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
  selection_cli:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - certutil
    - bitsadmin
    - DownloadString
    - Invoke-WebRequest
    - Invoke-Expression
    - FromBase64String
    - -enc
    - -EncodedCommand
    - curl
    - ipconfig /all
    - nltest
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Splunk admin-authored scripted inputs or alert actions that call cmd.exe or PowerShell
  for inventory collection
- Splunk app add-ons that run network configuration commands from scripted inputs
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0457.html
```

### Splunk Daemon Spawning Shell With Download or Reverse Shell Pattern (Linux)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

splunkd spawning sh/bash with download, reverse-shell or payload-staging arguments on Linux, consistent with command execution following Splunk Enterprise exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunk Daemon Spawning Shell With Download or Reverse Shell Pattern (Linux)
id: f723f997-57ab-565b-91b4-76ccb33eedc7
status: experimental
description: Detects splunkd spawning a shell whose command line shows payload download,
  staging or reverse-shell behaviour. Generalises the arbitrary OS command execution
  risk in Splunk Enterprise; matches technique pattern, not specific indicators.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /splunkd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cli:
    CommandLine|contains:
    - /dev/tcp/
    - nc -e
    - 'curl '
    - 'wget '
    - base64 -d
    - chmod +x
    - python -c
    - python3 -c
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Custom Splunk scripted inputs or alert actions that use curl or wget to call internal
  APIs
- Splunk app installers that fetch content via shell during setup
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0457.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0457.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c5150286-80ab-5191-90a3-e940116fd063/ncsc-nl-flags-30-splunk-enterprise-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup