> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Splunk and SolarWinds patch critical RCE and access control flaws in enterprise security tools - URL: https://f4n6.co.uk/security-feed/splunk-and-solarwinds-patch-critical-rce-and-access-control-flaws-in-enterprise-security-tools/ - Published: 2026-10-22T13:47:18.000Z - Updated: 2026-10-22T13:47:18.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407, CVE-2026-28328 ## 1\. Executive summary Splunk released security updates on 21 October 2026 for Splunk Enterprise (versions 9.4.16, 10.0.11, 10.2.8 and 10.4.4) and Splunk SOAR 8.7.0, fixing 16 CVEs in Enterprise and 15 in SOAR plus more than a dozen third-party library flaws. SolarWinds shipped Observability Self-Hosted 2026.4 and Patch Manager 2026.4, including a fix for CVE-2026-28328, which carries a CVSS of 8.8 HIGH (CWE-863, incorrect authorization) and lets low-privileged users reach restricted information. None of the five CVEs named in this item appears in CISA KEV, and EPSS for CVE-2026-28328 is 0%. The exposure for EMEA financial services is concentrated in Splunk Enterprise and SOAR, which sit on the SIEM and SOAR tier and hold broad log and credential reach across the estate; a code execution or access control flaw there is a path to the detection and response stack itself, not to a peripheral application. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | Splunk Enterprise and SOAR, and SolarWinds Observability Self-Hosted and Patch Manager, are ICT third-party products under update; the fixes change the security posture of software the firm depends on | Third-party risk records for these products need the new versions logged, and the update cadence and vendor notification path should be checked against the contract | | NIS2 Art. 21(2)(d) | The item is a vendor patch cycle for supply chain components (Splunk, SolarWinds) used inside the monitored estate | Supply chain security measures should cover how these updates are assessed and applied, including the third-party library flaws bundled in the releases | ## 3\. Technical analysis & attack chain The source is a patch-roundup. It names five CVEs and gives severity labels but no exploitation detail, no proof-of-concept, no observed in-the-wild activity and no attack chain. What follows separates what the source states from what it does not. Confirmed steps, as far as the source supports them: 1. Splunk Enterprise versions 9.4.16, 10.0.11, 10.2.8 and 10.4.4 fix 16 CVEs in product code, including CVE-2026-76299 (improper access control) and CVE-2026-76302 (improper neutralization), both described as critical. 2. Splunk SOAR 8.7.0 fixes 15 CVEs in product code and more than a dozen in third-party libraries, including CVE-2026-76531 (data exposure) and CVE-2026-76407 (improper access control), both described as critical. 3. SolarWinds Observability Self-Hosted 2026.4 fixes CVE-2026-28328, a broken authorization schema issue that lets low-privileged users access restricted information. 4. SolarWinds Patch Manager 2026.4 fixes a medium-severity information disclosure bug; Observability also gets medium-severity XSS and SSRF fixes. The source does not give the vulnerable version ranges for any of the five CVEs, the affected components within each product, the authentication requirement for exploitation, or any indication that any of them has been exploited. It also does not say which of the 16 Enterprise CVEs are the high-severity RCE, DoS and authorization bypass flaws it mentions, so those cannot be tied to a CVE from this item. On the verified values: CVE-2026-28328 is CVSS 8.8 HIGH with CWE-863, and the source's "broken authorization schema" description matches that classification. The other four CVEs have no CVSS in NVD and no CISA KEV entry. The source calls CVE-2026-76299, CVE-2026-76302, CVE-2026-76531 and CVE-2026-76407 critical; NVD has not published a score for any of them, so the critical label rests on the vendor's own rating as relayed by SecurityWeek. Treat it as single-sourced until the Splunk advisory is read directly. The related coverage of CVE-2026-20253 (Splunk Enterprise, CVSS 9.8, unauthenticated file creation or truncation leading to RCE, fixed below 10.2.4 and 10.0.7) is a separate June 2026 flaw and is not part of this patch cycle. It is relevant only as context for how Splunk access control and file handling flaws have been rated before. Likewise the SolarWinds Observability RCE flaws CVE-2026-28324 and CVE-2026-28325 are from an earlier cycle and are not fixed by 2026.4 as described here. The practical concern for a financial services estate is placement. Splunk Enterprise indexes authentication, network and application logs and often holds service account credentials for data collection; SOAR holds automation playbooks with credentials to firewalls, EDR and ticketing systems. An access control or code execution flaw in either gives an attacker a route to the systems the firm uses to detect and respond to intrusion. SolarWinds Observability and Patch Manager sit in the monitoring and endpoint patch tier with similar reach. The source gives no evidence any of these flaws has been used, and the EPSS and KEV positions do not support treating them as actively exploited. ## 4\. Mitigation & containment P1 within 24 hours: - Inventory every Splunk Enterprise and SOAR instance and record its version. Upgrade Enterprise to 9.4.16, 10.0.11, 10.2.8 or 10.4.4 as appropriate to the branch, and SOAR to 8.7.0\. The source names these as the fixed versions; confirm the exact fixed build against the Splunk advisory before scheduling. - Upgrade SolarWinds Observability Self-Hosted and Patch Manager to 2026.4\. CVE-2026-28328 is the priority here: it is the only CVE in this item with a published CVSS (8.8 HIGH) and it lets a low-privileged account read restricted data. - Restrict network access to Splunk web and management ports and to SolarWinds Observability and Patch Manager interfaces to known administrative networks until the upgrades are applied. P2 within 72 hours: - Review Splunk and SolarWinds account permissions. CVE-2026-76299, CVE-2026-76407 and CVE-2026-28328 are all access control or authorization flaws, so any account with more reach than its role needs is extra exposure. Remove unused accounts and service principals. - Check SOAR playbook credentials. SOAR 8.7.0 fixes 15 code CVEs and more than a dozen third-party library flaws; rotate any credential stored in a playbook that was reachable from a lower-privileged SOAR account. - Confirm the third-party library fixes in the SOAR release are included in the build you deploy, not deferred. P3 within 7 days: - Add the fixed versions to the patch baseline and asset inventory, and record the update against the third-party risk entry for each product. - Where the source's severity labels cannot be matched to a CVE (the high-severity RCE, DoS and authorization bypass flaws in Enterprise), read the Splunk advisory directly to get the CVE-to-component mapping before closing the item. The source gives no vendor workaround, no configuration flag and no mitigation short of upgrading. Do not assume one exists. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The item is a patch announcement with no hashes, network indicators, file paths or exploitation artefacts. Behavioural indicators cannot be given either: the source describes no observed activity. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no threat artefacts (no strings, command lines, file paths, registry keys or network values) from which a rule could be built. Detection for this item is version-based: query asset inventory for Splunk Enterprise builds below 9.4.16, 10.0.11, 10.2.8 or 10.4.4, SOAR below 8.7.0, and SolarWinds Observability Self-Hosted and Patch Manager below 2026.4. ## CVE assessment 5 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-28328](https://nvd.nist.gov/vuln/detail/CVE-2026-28328?ref=f4n6.co.uk) | 8.8 High | — | 0% | SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged us… | | [CVE-2026-76299](https://nvd.nist.gov/vuln/detail/CVE-2026-76299?ref=f4n6.co.uk) | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal s… | | [CVE-2026-76302](https://nvd.nist.gov/vuln/detail/CVE-2026-76302?ref=f4n6.co.uk) | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal s… | | [CVE-2026-76531](https://nvd.nist.gov/vuln/detail/CVE-2026-76531?ref=f4n6.co.uk) | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal s… | | [CVE-2026-76407](https://nvd.nist.gov/vuln/detail/CVE-2026-76407?ref=f4n6.co.uk) | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal s… | ## 7\. Sources - SecurityWeek, "Splunk, SolarWinds Release Fresh Security Updates", 2026-10-22\. https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ - The Hacker News, "Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication" (context on CVE-2026-20253, separate cycle). https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html - SecurityWeek, "SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted" (context on CVE-2026-28324 and CVE-2026-28325, separate cycle). https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/ ## 8\. Adverse Trace position Adverse Trace assesses this as a routine vendor patch cycle with no evidence of exploitation: none of the five named CVEs is in CISA KEV, EPSS for CVE-2026-28328 is 0%, and only that CVE has a published score (8.8 HIGH). The severity labels for the four Splunk CVEs are single-sourced to the vendor via SecurityWeek and should be confirmed against the Splunk advisory before they drive prioritisation. The client impact is not in the CVSS numbers but in placement: Splunk Enterprise, SOAR and SolarWinds Observability and Patch Manager sit in the monitoring, automation and patching tier, and an access control flaw there exposes the systems used to detect and respond to intrusion. We will pull the Splunk and SolarWinds advisories to get the vulnerable version ranges and the CVE-to-component mapping the source omits, and we will re-check KEV and EPSS for all five CVEs over the next 14 days. Clients should treat the version inventory and the P1 upgrades as the action this week. --- [Read the original source →](https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*