Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NISAC-200-202610-00000010

[Description]
Researchers have discovered a Missing Authentication vulnerability (CVE-2026-76268) in Splunk Enterprise. An unauthenticated remote attacker can exploit a flaw in the Patroni REST API of Search Head cluster members that allows critical configuration operations without requiring authentication, thereby executing arbitrary operating system commands. Please confirm and take action as soon as possible.

[Affected Platforms]
Splunk Enterprise versions 10.4.0 to 10.4.2
Splunk Enterprise versions 10.2.0 to 10.2.6

[Recommended Measures]
The vendor has released patches or updates for the vulnerability. Please refer to the official instructions for remediation. The URL is as follows: https://advisory.splunk.com/advisories/SVD-2026-1001

Mitigation: If Edge Processor, OpAmp, or SPL2 Data Pipelines are not in use, the PostgreSQL Sidecar can be disabled (set disabled = true in the [postgres] section of $SPLUNK_HOME/etc/system/local/server.conf), then restart Splunk Enterprise to apply the changes.

[References]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268
2. https://advisory.splunk.com/advisories/SVD-2026-1001