Skip to content
COOEY

FAIL › dossier

Splunk

COMPANY FEDRAMP MARKET

FedRAMP provider · · dossier confidence 20%

Splunk is a major cybersecurity data analytics vendor with a recent history of critical vulnerabilities allowing unauthenticated attackers to achieve RCE, access all data, and escalate privileges via embedded report tokens and improper authorization boundaries.

Failure events
11
Zero-days
0
RCEs
1
On KEV
1
Critical
10
Worst shame
78
PROFILE
CategorycybersecurityWhat they doSplunk provides data analytics, machine learning, and artificial intelligence software for security, IT, and business operations. Websitehttps://www.splunk.com ↗
SECURITY POSTURE

Splunk has a poor security posture, evidenced by multiple critical vulnerabilities in 2026 affecting unauthenticated access, RCE, and data exposure across Enterprise and SOAR products.

Notable failures
  • CVE-2026-76310: Unauthenticated RCE via embedded report tokens
  • CVE-2026-76312: Unauthenticated data access via HTML source reading
  • CVE-2026-76311: Unauthenticated data access via dispatch archives
  • CVE-2026-20253: Unauthenticated file creation/truncation via PostgreSQL sidecar
Patterns: repeated unauthenticated access via embedded report tokens; improper authorization boundary enforcement; session material exposure leading to privilege escalation
FAILURE HISTORY · 15
DATEEVENTSEVSUMMARY
2026-08-19 CVE-2026-76312 critical Unauthenticated users can access all data and affect system integrity in Splunk Enterprise by reading HTML source of embedded reports due to improper authorization boundary enforcement.
2026-08-19 CVE-2026-76310 critical Unauthenticated users with embedded report tokens in Splunk Enterprise can download dispatch archives, recover session material, and perform administrative actions.
2026-08-19 CVE-2026-76312 critical Unauthenticated users can access all data and affect system integrity in Splunk Enterprise by reading HTML source of embedded reports due to improper authorization boundary enforcement.
2026-08-19 CVE-2026-76310 critical Unauthenticated users with embedded report tokens in Splunk Enterprise can download dispatch archives, recover session material, and perform administrative actions.
2026-08-19 CVE-2026-76311 critical Unauthenticated users with embedded report tokens can download dispatch archives and access all data on Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
2026-08-19 CVE-2026-76311 critical Unauthenticated users with embedded report tokens can download dispatch archives and access all data on Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
2026-06-18 CVE-2026-20253 high Splunk Enterprise allows unauthenticated users to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint.
2026-10-07 CVE-2026-76285 critical Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contained multiple internally identified vulnerabilities grouped under CVE-2026-76285 due to improper adherence to coding standards.
2026-10-07 CVE-2026-76285 critical Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contained multiple internally identified vulnerabilities grouped under CVE-2026-76285 due to improper adherence to coding standards.
2023-02-23 CVE-2023-23914 critical CVE-2023-23914: A cleartext transmission of sensitive information vulnerability exists in curl <
2022-12-05 CVE-2022-32221 critical CVE-2022-32221: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`
2022-11-22 CVE-2022-36227 critical CVE-2022-36227: In libarchive before 3.6.2, the software does not check for an error after calli
2022-07-07 CVE-2022-32207 critical CVE-2022-32207: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes
2021-09-23 CVE-2021-22945 critical CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some
2021-06-02 CVE-2021-3520 critical CVE-2021-3520: There's a flaw in lz4. An attacker who submits a crafted file to an application
FEDRAMP CATALOG PRODUCTS · 2
PRODUCTSTATUSIMPACT
Splunk Cloud Platform for FedRAMP HighIn ProcessHigh
Splunk Cloud Platform for FedRAMP ModerateAuthorizedModerate
DOSSIER SOURCES
Open questions: Exact founding year and headquarters location not explicitly confirmed in provided web evidence · Current employee count and precise ownership structure not verified in provided sources
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-02 04:22:07.079809+00:00