Splunk SolarWinds patches: urgent updates for multiple vulnerabilities

Splunk and SolarWinds released security updates this week to fix a range of serious weaknesses in their products. The rollout covers multiple types of issues, including remote code execution, privilege escalation, denial-of-service, and information disclosure, according to SecurityWeek.

What the Splunk SolarWinds patches fix

According to SecurityWeek, Splunk issued updates for both Splunk Enterprise and Splunk SOAR. Splunk Enterprise updates were published for versions 9.4.16, 10.0.11, 10.2.8, and 10.4.4, and together they address 16 CVEs in the product code. The vendor patched a mix of defects, with two of the listed CVEs, CVE-2026-76299 and CVE-2026-76302, described as critical improper access control and improper neutralization issues. The Enterprise fixes also cover high-severity remote code execution, denial-of-service, authorization bypasses, and resource control weaknesses.

Splunk SOAR was updated to version 8.7.0, which SecurityWeek says includes fixes for 15 vulnerabilities in the product itself plus more than a dozen issues in third-party libraries. The most severe SOAR bugs called out are CVE-2026-76531 and CVE-2026-76407, labeled critical for data exposure and improper access control, with additional high-severity information disclosure, improper neutralization, and resource control issues addressed.

SolarWinds released updates that target an authorization problem in Observability that could allow users with low privileges to view restricted data, tracked as CVE-2026-28328. The company also patched medium-severity cross-site scripting and server-side request forgery issues in Observability and a medium-severity information disclosure bug in Patch Manager. Those fixes are included in Observability Self-Hosted 2026.4 and Patch Manager 2026.4, SecurityWeek reports.

For the full vendor details see the SecurityWeek coverage: Splunk, SolarWinds Release Fresh Security Updates.

Who should pay attention

• Organizations running any of the listed Splunk Enterprise versions or Splunk SOAR should consider these updates high priority. SecurityWeek lists specific product versions and CVE identifiers that were fixed.
• Teams using SolarWinds Observability Self-Hosted or Patch Manager should also apply the 2026.4 updates, especially if multiple users with differing privilege levels have access to the systems.
• If you use hosted or managed versions of these products, check with your provider or internal operations team to confirm when updates will be applied.

Practical steps to take now

• Apply vendor updates promptly to the affected products and versions noted by SecurityWeek. Installing the releases for Splunk Enterprise, Splunk SOAR, Observability Self-Hosted 2026.4, and Patch Manager 2026.4 will address the defects the vendors reported.
• Review user roles and privileges for Splunk and SolarWinds products, looking for accounts with broader access than needed, because several fixes address improper access control and authorization bypass issues.
• Monitor logs and alerts for unusual behavior around the time you deploy updates, and for indicators of data access or execution attempts prior to patching.
• Test updates in a staging environment when possible before rolling them into production, and ensure you have recent backups and a rollback plan.
• If you need a quick external check of your public-facing site, start with a free external scan.

A closer look at the most serious fixes

SecurityWeek highlights several critical CVEs in the Splunk updates that are tied to improper access control and improper neutralization, and it points to critical data exposure and access control issues in SOAR. In SolarWinds, the highest-severity listed defect is an authorization schema problem that could let lower-privileged users view information they should not see. Both vendors also addressed medium-severity issues, such as cross-site scripting and server-side request forgery in Observability, plus an information disclosure issue in Patch Manager.

Treat the critical and high-severity fixes as priority work because they affect core controls: access checks, neutralization of input, and resource management. Medium-severity issues like XSS and SSRF are also important, especially where they affect customer-facing interfaces or automation tooling.

Long-term risk management

Patching is necessary, but not sufficient. Use these updates as a prompt to revisit basic controls around monitoring, least privilege, and third-party library management: ensure that dependency inventories are current, that you have an established process for applying vendor security advisories, and that teams know how to respond when a vendor reports multiple CVEs at once. Keep communication lines open with any managed service providers about patch schedules and verification.

If you want to confirm how exposed your public site is, start with a free external scan at our security page, or contact your operations team to coordinate patching and monitoring plans.