【資安漏洞預警】Splunk Enterprise存在高風險安全漏洞(CVE-2026-76268)，請儘速確認並進行處置

【行政公告】

公告單位	圖資處網路系統組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】Splunk Enterprise存在高風險安全漏洞(CVE-2026-76268)，請儘速確認並進行處置【Security Vulnerability Alert】Splunk Enterprise has a high-risk security vulnerability (CVE-2026-76268), please confirm and take action as soon as possible
公告內容	轉發國家資安資訊分享與分析中心資安訊息警訊 NISAC-200-202610-00000010 [內容說明] 研究人員發現Splunk Enterprise存在缺乏身分鑑別(Missing Authentication)漏洞(CVE-2026-76268)，未經身分鑑別之遠端攻擊者，可利用Search Head叢集成員之Patroni REST API對關鍵組態操作未要求身分鑑別之缺陷，進而執行任意作業系統指令，請儘速確認並進行處置。 [影響平台] Splunk Enterprise 10.4.0至10.4.2版本 Splunk Enterprise 10.2.0至10.2.6版本 [建議措施] 官方已針對漏洞釋出修補或更新，請參考官方說明進行處置，網址如下： https://advisory.splunk.com/advisories/SVD-2026-1001 緩解方式：若未使用Edge Processor、OpAmp或SPL2 Data Pipelines，可關閉PostgreSQL Sidecar(在$SPLUNK_HOME/etc/system/local/server.conf之[postgres]區段設定disabled = true)，再重啟Splunk Enterprise套用變更。 [參考資料] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268 2. https://advisory.splunk.com/advisories/SVD-2026-1001 Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NISAC-200-202610-00000010 [Description] Researchers have discovered a Missing Authentication vulnerability (CVE-2026-76268) in Splunk Enterprise. An unauthenticated remote attacker can exploit a flaw in the Patroni REST API of Search Head cluster members that allows critical configuration operations without requiring authentication, thereby executing arbitrary operating system commands. Please confirm and take action as soon as possible. [Affected Platforms] Splunk Enterprise versions 10.4.0 to 10.4.2 Splunk Enterprise versions 10.2.0 to 10.2.6 [Recommended Measures] The vendor has released patches or updates for the vulnerability. Please refer to the official instructions for remediation. The URL is as follows: https://advisory.splunk.com/advisories/SVD-2026-1001 Mitigation: If Edge Processor, OpAmp, or SPL2 Data Pipelines are not in use, the PostgreSQL Sidecar can be disabled (set disabled = true in the [postgres] section of $SPLUNK_HOME/etc/system/local/server.conf), then restart Splunk Enterprise to apply the changes. [References] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-76268 2. https://advisory.splunk.com/advisories/SVD-2026-1001
相關訊息	參考資料1 參考資料2
公告時間	2026/10/27 至 2027/4/27	點閱次數	149