【Vulnerability Alert】High-Risk Security Vulnerability in Splunk Enterprise (CVE-2026-76268), Please Verify and Handle Promptly

• Subject:【Vulnerability Alert】High-Risk Security Vulnerability in Splunk Enterprise (CVE-2026-76268), Please Verify and Handle Promptly

• Description:
  • Forwarded NISAC Cybersecurity Message Alert NISAC-200-202610-00000010
  • Researchers have discovered a Missing Authentication vulnerability (CVE-2026-76268) in Splunk Enterprise. An unauthenticated remote attacker can exploit the lack of authentication on critical configuration operations of the Patroni REST API of Search Head cluster members to execute arbitrary operating system commands. Please verify and handle promptly.
• Affected Platforms:
  • Splunk Enterprise versions 10.4.0 through 10.4.2
  • Splunk Enterprise versions 10.2.0 through 10.2.6
• Recommended Actions:
  • The vendor has released a patch or update for the vulnerability, please refer to the vendor's instructions for remediation; URL is as follows: https://advisory.splunk.com/advisories/SVD-2026-1001
  • Mitigation: If Edge Processor, OpAmp, or SPL2 Data Pipelines are not in use, you can disable the PostgreSQL Sidecar (set disabled = true in the [postgres] section of $SPLUNK_HOME/etc/system/local/server.conf) and then restart Splunk Enterprise to apply the changes.
• References:
  1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268
  2. https://advisory.splunk.com/advisories/SVD-2026-1001

Computer and Communication Center
Network System Division