---
title: Splunk October 2026 updates: critical hardening fixes in Splunk Enterprise (up to CVSS 9.9) and SOAR (up to 9.3); upgrade to 10.4.4 / 10.2.8 / 10.0.11 / 9.4.16 and SOAR 8.7.0 | ctxsec
url: https://ctxsec.com/items/splunk-oct-2026-enterprise-soar-critical
description: ""
status: "confirmed (Splunk advisories SVD-2026-1007/1008/1011/1012, Oct 21); internally found, no exploitation reported"
published: 2026-10-22
---

> 

[← Cybersecurity News](/news) · [markdown](/items/splunk-oct-2026-enterprise-soar-critical.md)

confirmed (Splunk advisories SVD-2026-1007/1008/1011/1012, Oct 21); internally found, no exploitation reported

2026-10-22

### Splunk October 2026 updates: critical hardening fixes in Splunk Enterprise (up to CVSS 9.9) and SOAR (up to 9.3); upgrade to 10.4.4 / 10.2.8 / 10.0.11 / 9.4.16 and SOAR 8.7.0

Splunk published its October batch on **Oct 21**.

- **SVD-2026-1008 (Critical, CVSS up to 9.9):** four internally found Splunk Enterprise bugs grouped by weakness (CVE-2026-76299 to -76302: improper access control, resource lifetime, protection-mechanism failure, improper neutralization). Affects 10.4.0-10.4.3, 10.2.0-10.2.7, 10.0.0-10.0.10 and 9.4.0-9.4.15. Fixed in **10.4.4, 10.2.8, 10.0.11, 9.4.16**.
- **SVD-2026-1007 (High):** 12 more Enterprise CVEs, including a Data Management REST API authorization bypass and several DoS bugs, one via unauthenticated package downloads over the REST API.
- **SVD-2026-1011 (Critical):** eight Splunk SOAR CVEs (CVE-2026-76407 onward), including improper access control and files exposed to external parties. Fixed in **SOAR 8.7.0**, which also updates 49 third-party package CVEs (SVD-2026-1012, e.g. PostgreSQL 15.18, PyJWT 2.13.0).

SolarWinds also shipped Observability Self-Hosted 2026.4 and Patch Manager 2026.4 this week, fixing a high-severity broken-authorization bug (CVE-2026-28328) plus medium XSS/SSRF and info-disclosure issues, per SecurityWeek.

**Do now:** SIEM and SOAR hold credentials for everything else, so schedule these upgrades this week and keep Splunk Web and the management port off the internet.

Sources: [Splunk advisories (SVD-2026-1007, -1008, -1011, -1012)](https://advisory.splunk.com/advisories) · [Splunk SVD-2026-1011: Security Hardening in Splunk SOAR](https://advisory.splunk.com/advisories/SVD-2026-1011) · [SecurityWeek: Splunk, SolarWinds release fresh security updates (Oct 22)](https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/)