Splunk August 2026: 60+ flaws, three rated 9.4 need no login

Splunk, the log monitoring platform widely used across enterprises, published eight security advisories at once on August 19, 2026. The advisory covering Splunk Enterprise alone fixes roughly 60 vulnerabilities, and the most severe carries a rating of 9.4 out of 10. It lets someone who has not logged in walk off with the storage area holding search results.

Splunk collects the activity records — logs — that servers and network devices emit, then makes them searchable in one place. In Japan, Toyota Systems, Panasonic Information Systems, KDDI and Olympus have all published case studies, which puts the product exactly where internal information concentrates. The tool built to watch for attacks is itself the target here.

What the August 2026 release fixes

The eight advisories are split by product.

CVE-2026-76310 and CVE-2026-76311: the search-result store, taken whole (9.4)

Splunk keeps the output of a search in a temporary area called the dispatch directory. In these two flaws, anyone holding an embedded report token can download that entire area without logging in. What comes out includes user session material, which opens a further path to impersonating a legitimate user.

Report embedding is the feature teams use to drop a chart into an internal portal or dashboard. If you do not embed reports, exposure is limited. If you do, that token has effectively been an admission ticket.

CVE-2026-76312: viewing a page's source is enough (9.4)

Also no login required. Anyone able to read the HTML source of a page that embeds a Splunk report can download assets from it. Viewing source is something any visitor can do, so the conditions line up easily when the embedding page is reachable from outside. This one alone is fixed in 10.4.1, meaning the 10.4 line is already covered by a shipped release.

CVE-2026-76404: OS commands through an add-on app (9.1)

This sits in the Splunk MCP Server app rather than the core product. A user holding the admin role can run arbitrary commands on the operating system hosting Splunk. The fix is 1.2.1. The same apps-and-add-ons advisory also covers Splunk AI Toolkit (6.0.0 / 6.0.1) and Splunk Connect for Kafka (2.2.7). Upgrading the core product does not carry the add-ons with it.

Affected and fixed versions

Transcribed as Splunk writes them.

There are individual exceptions. CVE-2026-76316 (8.8) is fixed in 10.4.1 and 10.2.5. CVE-2026-76259 (8.8, Windows only) also lists 9.3.14 among its fixes. CVE-2026-76262 and CVE-2026-76355 affect only the 10.4 line and do not touch earlier versions. If your version sits near one of these boundaries, check Splunk's text for the specific CVE.

One notable absence: none of the eight advisories mention Splunk Cloud Platform. Previous batches routinely carried a line stating that Splunk monitors and patches Cloud Platform instances, along with affected Cloud version numbers. This batch has neither. If you run the cloud product, its status cannot be determined from the published material — ask Splunk directly.

Two that upgrading alone will not fix

Miss these and the hole stays open while the ticket reads "done". Splunk states explicitly that additional steps are required.

• CVE-2026-76338 — set strictPeerNameValidation = true in authentication.conf on every distributed node, then restart Splunk Enterprise
• CVE-2026-76352 — after upgrading, set scripted_lookup_raw_write_enforcement = block under [lookup] in limits.conf, then restart

On the SOAR side, CVE-2026-76362 also requires additional steps. In a distributed deployment a single missed node blunts the effect, so build the target list before starting.

Checking the version you are running

• In the UI — Help menu, then About
• From the CLI — $SPLUNK_HOME/bin/splunk -version
• From a file — $SPLUNK_HOME/etc/splunk.version
• Across many instances — | rest splunk_server=local count=1 /services/server/info | table version

Where search heads and indexers are separated, the fourth method is the practical one for taking stock. Universal Forwarder counts tend to run high, so pin that number down early too.

Is any of this being exploited

Not in this batch. Splunk's advisories carry no statement of observed attacks, and as of the August 19, 2026 edition none of these IDs appear in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-20253: attacked for real in June 2026

That said, Splunk was hit recently. CVE-2026-20253 (rated 9.8), published in June 2026, let an unauthenticated attacker create and truncate files on the server. Splunk updated its advisory on June 18 to state that it had become aware of limited exploitation, and CISA added it to the KEV catalog the same day.

That issue covered Splunk Enterprise 10.2.0–10.2.3 (fixed in 10.2.4) and 10.0.0–10.0.6 (fixed in 10.0.7); the 10.4 line and 9.4 and earlier were unaffected. Moving to the August releases clears it as well. If you are still sitting on 10.2.3 or below, or 10.0.6 or below, you have a hole with a track record of real-world exploitation. Close that before the August work.

Versions past end of support

Splunk supports each minor version for 24 months from its release.

The 9.3 line is already past its date. It does not appear in the product status table of the Splunk Enterprise advisory; the number 9.3.14 surfaces only inside individual CVE descriptions. If you run 9.3, assume this batch does not close for you and start from a version-upgrade plan. On 9.4 you have roughly four months left, so folding the upgrade into this round of work saves rework.

What to do now

• Take stock of current versions. Anything at 10.2.3 or below, or 10.0.6 or below, still carries the exploited CVE-2026-20253 and comes first
• Move Splunk Enterprise to 10.4.2 / 10.2.6 / 10.0.9 / 9.4.14 or later
• Apply the configuration changes for CVE-2026-76338 and CVE-2026-76352 on every node in a distributed deployment, then restart
• Upgrade SOAR (8.6.0), Enterprise Security (8.6.1), Secure Gateway, and apps such as MCP Server, AI Toolkit and Connect for Kafka separately
• If you embed reports, check whether the embedding pages are reachable from outside
• On Splunk Cloud Platform, ask Splunk where these eight advisories stand

Splunk publishes its security advisories in English only, and they continue to run on a separate channel from Cisco's own advisories even after the acquisition closed on March 18, 2024.

Summary

What the three 9.4 flaws share is that none of them require going through a login. Report embedding — an unremarkable-looking convenience feature — is the way in, and the more charts you have pinned into internal portals, the more readily the conditions line up.

Nothing in this batch has been reported as attacked. But there is a June 2026 precedent, and some deployments may still be missing that fix. Taking stock of versions first tells you immediately which situation you are in. Plan it as one piece of work, configuration changes included.

Sources

• Splunk Vulnerability Disclosure (SVD-2026-0801 to 0808, published August 19, 2026)
• SVD-2026-0801 Security Hardening Release for Splunk Enterprise - August 2026
• SVD-2026-0808 Security Hardening Release for Splunk Apps and Add-ons - August 2026
• SVD-2026-0603 (CVE-2026-20253, June 2026)
• Splunk Software Support Policy
• Determine which version of Splunk Enterprise you're running (Splunk)
• CISA Known Exploited Vulnerabilities Catalog (checked against the August 19, 2026 edition)