Splunk fixes critical flaws in Enterprise and SOAR, SolarWinds patches Observability

Splunk has released its October 2026 security advisories, fixing dozens of vulnerabilities in Splunk Enterprise and Splunk SOAR, including issues the company rates critical, while SolarWinds has shipped updates for its Observability and Patch Manager products. The advisories were published on October 21, according to Splunk's security advisory portal, and were summarized by SecurityWeek on October 22. Because Splunk platforms sit at the heart of many security operations centers and collect sensitive log data, flaws in them are an attractive target for attackers.

What happened

Splunk's advisory portal lists six new October advisories dated October 21. Two "Security Hardening" advisories, SVD-2026-1008 for Splunk Enterprise and SVD-2026-1011 for Splunk SOAR, are rated critical with an overall CVSS score of 9.9. Splunk did not map individual scores to each CVE in those advisories. A third-party package update advisory for Splunk Enterprise (SVD-2026-1009) is also rated critical, while separate advisories covering product-code vulnerabilities in Enterprise (SVD-2026-1007, overall CVSS 8.8) and SOAR (SVD-2026-1010, overall CVSS 7.5) are rated high.

Technical details

According to SecurityWeek, Splunk Enterprise received fixes for 16 CVEs in its own code plus flaws in third-party packages. The critical issues are CVE-2026-76299 and CVE-2026-76302, described as improper access control and improper neutralization flaws. High-severity issues include remote code execution, denial of service, authorization bypass and improper resource control.

Splunk SOAR received fixes for 15 vulnerabilities in its own code and more than a dozen in third-party libraries, SecurityWeek reports. Its critical flaws are CVE-2026-76407, which Splunk titles "Improper Access Control in Splunk SOAR," and CVE-2026-76531, titled "Files or Directories Accessible to External Parties in Splunk SOAR."

SolarWinds, meanwhile, fixed CVE-2026-28328, a high-severity broken authorization issue in Observability that could allow low-privileged users to access restricted information, along with medium-severity cross-site scripting and server-side request forgery bugs, SecurityWeek reports. A medium-severity information disclosure flaw was also fixed in Patch Manager.

Neither Splunk nor SolarWinds has reported exploitation of these vulnerabilities in the wild, according to SecurityWeek. Separately, Splunk published an informational advisory stating that no Splunk products are known to be affected by the recently disclosed PHP2Shell vulnerabilities.

Who is affected

Organizations running self-managed Splunk Enterprise on versions earlier than the fixed releases, Splunk SOAR earlier than 8.7.0, and SolarWinds Observability Self-Hosted or Patch Manager earlier than 2026.4 are affected.

What to do

• Upgrade Splunk Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4, depending on the release branch in use.
• Upgrade Splunk SOAR to 8.7.0.
• Update SolarWinds Observability Self-Hosted and Patch Manager to 2026.4.
• Review the individual Splunk advisories for per-CVE conditions and restrict network access to Splunk management interfaces until patches are applied.