Splunk October 2026 updates: critical hardening fixes in Splunk Enterprise (up to CVSS 9.9) and SOAR (up to 9.3); upgrade to 10.4.4 / 10.2.8 / 10.0.11 / 9.4.16 and SOAR 8.7.0

confirmed (Splunk advisories SVD-2026-1007/1008/1011/1012, Oct 21); internally found, no exploitation reported2026-10-22

Splunk October 2026 updates: critical hardening fixes in Splunk Enterprise (up to CVSS 9.9) and SOAR (up to 9.3); upgrade to 10.4.4 / 10.2.8 / 10.0.11 / 9.4.16 and SOAR 8.7.0

Splunk published its October batch on Oct 21.

SVD-2026-1008 (Critical, CVSS up to 9.9): four internally found Splunk Enterprise bugs grouped by weakness (CVE-2026-76299 to -76302: improper access control, resource lifetime, protection-mechanism failure, improper neutralization). Affects 10.4.0-10.4.3, 10.2.0-10.2.7, 10.0.0-10.0.10 and 9.4.0-9.4.15. Fixed in 10.4.4, 10.2.8, 10.0.11, 9.4.16.
SVD-2026-1007 (High): 12 more Enterprise CVEs, including a Data Management REST API authorization bypass and several DoS bugs, one via unauthenticated package downloads over the REST API.
SVD-2026-1011 (Critical): eight Splunk SOAR CVEs (CVE-2026-76407 onward), including improper access control and files exposed to external parties. Fixed in SOAR 8.7.0, which also updates 49 third-party package CVEs (SVD-2026-1012, e.g. PostgreSQL 15.18, PyJWT 2.13.0).

SolarWinds also shipped Observability Self-Hosted 2026.4 and Patch Manager 2026.4 this week, fixing a high-severity broken-authorization bug (CVE-2026-28328) plus medium XSS/SSRF and info-disclosure issues, per SecurityWeek.

Do now: SIEM and SOAR hold credentials for everything else, so schedule these upgrades this week and keep Splunk Web and the management port off the internet.

Sources: Splunk advisories (SVD-2026-1007, -1008, -1011, -1012) · Splunk SVD-2026-1011: Security Hardening in Splunk SOAR · SecurityWeek: Splunk, SolarWinds release fresh security updates (Oct 22)