Splunk, SolarWinds Release Fresh Security Updates

Splunk and SolarWinds have both shipped security updates this week to close out numerous vulnerabilities affecting their flagship products. Splunk pushed fixes for Splunk Enterprise (versions 9.4.16, 10.0.11, 10.2.8, 10.4.4) covering 16 internal CVEs, among them the critical-rated CVE-2026-76299 and CVE-2026-76302 tied to access-control and input-sanitization weaknesses, alongside high-severity remote code execution, denial-of-service and authorization-bypass bugs. Splunk SOAR 8.7.0 received patches for 15 in-house flaws plus more than a dozen third-party library issues, headlined by the critical CVE-2026-76531 and CVE-2026-76407 data-exposure and access-control bugs, as well as high-severity information-disclosure problems. Separately, SolarWinds fixed a high-severity broken-authorization flaw in Observability (CVE-2026-28328) that could let low-privileged users view restricted data, plus medium-severity XSS, SSRF and information-disclosure issues in Observability Self-Hosted 2026.4 and Patch Manager 2026.4. No active exploitation has been reported, but organizations running these products should apply the updates promptly.