Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

Splunk has disclosed a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to execute operating-system commands through an exposed Patroni REST API.

Tracked as CVE-2026-76268, the flaw carries a CVSS v3.1 score of 9.8 and affects search head cluster members running vulnerable releases in the 10.4 and 10.2 branches.

The vulnerability stems from missing authentication for critical configuration operations in the Patroni interface. An attacker needs network access to that interface on a search head cluster member, but does not need a Splunk account or user interaction.

Critical Splunk Enterprise Vulnerability

CVE-2026-76268 affects Splunk Enterprise 10.4 releases before 10.4.3 and 10.2 releases before 10.2.7. Splunk explicitly states that the 10.0.x and 9.4.x branches are not affected by this particular vulnerability.

The attack condition is access to the Patroni REST API, rather than simply access to Splunk Web. This distinction matters when assessing which deployed cluster members expose the vulnerable interface.

The advisory credits Splunk researcher Gabriel Nitu with discovering the flaw. It does not provide an exploit payload, identify active exploitation, or describe a publicly available proof of concept.

Consequently, the disclosure establishes a serious unauthenticated command-execution risk without confirming that attackers have exploited it in operational environments.

The same advisory documents 17 vulnerabilities: one critical, one high, and 15 medium-severity issues. The high-severity flaw, CVE-2026-76266, allows a local attacker operating as the Splunk service account to manipulate installation content so a subsequent Linux package upgrade executes attacker-controlled commands as root.

Exploitation requires an affected upgrade after the installation is modified; it is not unrestricted, immediate privilege escalation.

Other weaknesses expose search queries, job metadata, results, and private SPL2 module definitions. CVE-2026-76274 enables server-side request forgery that can disclose an Observability Cloud API token.

Several Secure Gateway flaws permit unauthorized payload signing or modification of alert and mobile-device recipient data. These issues require authenticated access or specified capabilities, unlike the critical Patroni vulnerability.

Splunk recommends upgrading to Enterprise 10.4.3, 10.2.7, 10.0.10, or 9.4.15, or later releases. Organizations not using Edge Processor, OpAmp, or SPL2 data pipelines can mitigate CVE-2026-76268 by setting disabled = true under [postgres] in $SPLUNK_HOME/etc/system/local/server.conf, then restarting Splunk Enterprise.

Additional remediation is required for four flaws. CVE-2026-76264 requires setting scripted_lookup_raw_write_enforcement = block under [lookup] in limits.conf after upgrading and restarting.

CVE-2026-76265, CVE-2026-76272, and CVE-2026-76280 require Secure Gateway upgrades to 3.10.11, 3.9.25, or 3.8.72, or higher. Splunk also documents disabling affected apps where upgrades cannot be completed, subject to feature dependencies.

The table covers all 17 CVEs verified in SVD-2026-1001. SVD-2026-1002 could not be retrieved despite repeated attempts, and a targeted search returned no results; any additional CVEs in that advisory remain unverified.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team