Critical Splunk Enterprise Vulnerability Lets Unauthenticated Attackers Execute OS Commands

Splunk disclosed 17 vulnerabilities in Splunk Enterprise, the most severe being CVE-2026-76268 — a critical (CVSS 9.8) unauthenticated operating-system command execution vulnerability in the Patroni REST API affecting search head cluster members on affected 10.4 and 10.2 releases; Splunk recommends upgrading to fixed releases (10.4.3, 10.2.7, 10.0.10, 9.4.15 or later) and documents configuration mitigations for environments that cannot immediately upgrade. The advisory also details one high and multiple medium-severity issues (including SSRF, privilege-manipulation during upgrades, and Secure Gateway flaws), per-CVE remediation or mitigation guidance, and states no exploit or active in-the-wild exploitation has been confirmed.