---
title: Splunk SVD-2026-1001: CVSS 9.8 unauthenticated RCE via Patroni REST API (CVE-2026-76268) plus 16 more fixes | ctxsec
url: https://ctxsec.com/items/splunk-svd-2026-1001
description: ""
status: "confirmed (vendor); PoC claims unverified"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/splunk-svd-2026-1001.md)

confirmed (vendor); PoC claims unverified

2026-10-14

### Splunk SVD-2026-1001: CVSS 9.8 unauthenticated RCE via Patroni REST API (CVE-2026-76268) plus 16 more fixes

Splunk's Oct 7 advisory fixes 17 Splunk Enterprise bugs. The critical one, CVE-2026-76268 (CVSS 9.8), lets an unauthenticated attacker with network access to the Patroni REST API on a **search head cluster member** run OS commands; it affects 10.4 before 10.4.3 and 10.2 before 10.2.7 (10.0.x and 9.4.x are not affected). Upgrade to 10.4.3 / 10.2.7 / 10.0.10 / 9.4.15. Workaround if you don't use Edge Processor, OpAmp or SPL2 pipelines: set `disabled = true` in the `[postgres]` stanza of server.conf and restart. Also fixed: a Linux package-upgrade local privesc (CVE-2026-76266, 7.7). Some extra CVEs (76264/65/72/80) need post-upgrade config or Secure Gateway upgrades. Public PoC claims are not verified here.

Sources: [Splunk SVD-2026-1001](https://advisory.splunk.com/advisories/SVD-2026-1001)