Splunk and SolarWinds this week released fixes for several vulnerabilities, including flaws that lead to code execution, elevation of privilege, denial of service (DoS), and data disclosure.
on wednesday, mud Released security updates for Splunk Enterprise and SOAR to address dozens of security flaws, including many flaws in third-party packages.
Splunk Enterprise versions 9.4.16, 10.0.11, 10.2.8, and 10.4.4 have been released with fixes for 16 CVEs in the product code, including CVE-2026-76299 and CVE-2026-76302, an inappropriate access issue.
Remote code execution (RCE), DoS, authorization traversal, and improper resource control vulnerabilities have been addressed.
Splunk SOAR version 8.7.0 has been released with patches for 15 vulnerabilities in its code and more than a dozen in third-party libraries. The most serious are CVE-2026-76531 and CVE-2026-76407, a vulnerability for information disclosure and inappropriate access control issues.
The update also fixes high-severity data exposure, false neutrality, inappropriate resource control, and security flaws.
SolarWinds Released a fix for a high-severity bug in Observability that could allow low-privileged users to access restricted data. Tracked as CVE-2026-28328, the flaw is described as a broken permissions issue.
In addition, the company has released security updates that address moderate-severity XSS and SSRF vulnerabilities in Observability, and moderate-severity data disclosure flaws in Patch Manager.
Observability Self-Hosted version 2026.4 and Patch Manager version 2026.4 contain patches for these security flaws.
Related: Cisco Patches 34 Vulnerabilities Across Multiple Products
Related: The PHP2Shell exploit started days before the update
Related: Oracle Patches Over 1,200 CPU Vulnerabilities October 2026
Related: Drupal warns of rapid exploit vulnerability for critical core RCE flaws
