Key facts
- The most severe SonicWall flaw, CVE-2026-102255, is a pre-authenticated SSRF caused by an unintended alternate access path and carries a CVSS score of 10.
- SonicWall says it has no evidence that these vulnerabilities are being exploited in the wild and that SSL-VPN on its firewall products is not affected.
- CVE-2026-76268 is a missing-authentication flaw in the Patroni REST API on Splunk search head cluster members, rated CVSS 9.8, that could allow unauthenticated OS command execution by an attacker with network access.
- The advisories reported no exploitation in the wild of the October Splunk flaws.
SonicWall released fixes for four vulnerabilities in its SMA1000 appliances, including one rated CVSS 10, SecurityWeek reports. The vendor urged customers to move to version 12.5.0-03082 or 12.4.3-03670. Splunk separately patched dozens of flaws across its Enterprise product, with three critical bugs among them. The simultaneous patching of two security vendors in the same news cycle is a reminder that the tools guarding networks need guarding too, and that a perfect severity score is not a hypothetical concern.
For IT teams managing both SonicWall and Splunk environments, the overlapping patch cycle means two separate upgrade tracks to coordinate in the same week.
The most severe SonicWall flaw, CVE-2026-102255, is a pre-authenticated server-side request forgery (SSRF, a bug that lets an attacker make a server send requests on their behalf). SecurityWeek reports it stems from an unintended alternate access path and scores CVSS 10. An SSRF at this severity level can let an attacker reach internal services that should not be exposed, making it a target for anyone scanning for weak points in perimeter defenses. The fact that it requires no authentication makes it particularly worrisome for appliances exposed to untrusted networks.
The unintended alternate access path means the bug does not require a sophisticated exploit; it can be triggered by a simple request to the right endpoint.
The SonicWall update also fixes two high-severity issues and one medium-severity issue that could enable remote code execution and cross-site scripting. SonicWall says SSL-VPN on its firewall products is not affected, which narrows the scope to the SMA1000 line specifically. The distinction matters for IT teams that manage both SMA1000 appliances and SonicWall firewalls: the patch list applies to one product family, not the other.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.
SonicWall, SecurityWeek
For SMA1000 customers, the practical step is the upgrade to one of the two listed versions. The vendor’s published guidance focuses on applying the patch and verifying the version.
Splunk: a Patroni flaw and a long patch list
Splunk patched dozens of flaws across Splunk Enterprise, MCP Server and the Add-on for Amazon Web Services. Three are critical Splunk Enterprise bugs involving command execution, unauthorized access and code injection, SecurityWeek reports. Splunk Enterprise often sits at the center of security operations, so compromise could expose sensitive data or blind defenders monitoring the network. A platform that aggregates logs from across the estate is a high-value target: get in, and you can see everything.
That makes Splunk a priority for attackers looking to move laterally or cover their tracks.
The standout is CVE-2026-76268, a missing-authentication flaw in the Patroni REST API on search head cluster members. Cyber Security News reports it was disclosed Oct. 7, 2026, and Daily CyberSecurity rates it CVSS 9.8. An attacker with network access could run operating system commands without authenticating.
A bug that bypasses authentication entirely and reaches the operating system is the kind of flaw that turns a network position into full control quickly. Patroni is a replication and failover component for PostgreSQL, which means the bug sits at the intersection of database infrastructure and Splunk’s search head architecture. A flaw in this component can affect not just data retrieval but the availability of the entire Splunk deployment.
The bug affects Splunk Enterprise 10.4 before 10.4.3 and 10.2 before 10.2.7. The 10.0.x and 9.4.x branches are not affected by this one, which narrows the exposure to customers on the two most recent release lines.
Across the two advisories, SVD-2026-1001 and SVD-2026-1002, fixes are available in 10.4.3, 10.2.7, 10.0.10 and 9.4.15. Four of the CVEs need extra steps beyond upgrading, which means a basic version bump is not enough for every bug on the list.
For customers who cannot upgrade immediately, Splunk says to disable the PostgreSQL sidecar, but only if Edge Processor, OpAmp and SPL2 data pipelines are unused. Restricting network access to search head cluster members is also advised. The workaround is narrow: it only applies if those components are not in use, and it targets the same PostgreSQL sidecar that was the vector for a separate flaw earlier this year.
Exploitation status and the June precedent
Daily CyberSecurity reports the Splunk advisories describe no exploitation in the wild of the October flaws. That is the good news, and it matches SonicWall’s own statement that its SMA1000 flaws show no signs of active exploitation. Both vendors are reporting a clean bill of health as of their advisory publication.
The history gives that statement a short shelf life. The Hacker News reports Splunk disclosed CVE-2026-20253, a separate unauthenticated PostgreSQL sidecar flaw also rated 9.8, on June 18, 2026. By June 21, Splunk had reported limited exploitation and CISA had added it to its Known Exploited Vulnerabilities catalog. A three-day window between disclosure and confirmed exploitation is a reminder that silence today does not guarantee safety tomorrow.
For security teams operating on a patch cadence of weeks, that window is uncomfortably tight, and it has shaped how many organizations focus on Splunk updates. The June bug is a different flaw, so nothing in the reporting says attackers have exploited the October Patroni bug or that it shares its cause.
However, the workaround again points at the PostgreSQL sidecar, so customers running Splunk Enterprise may be revisiting the same component twice in four months. That repetition is worth noting for IT teams that have already applied the June fixes: the sidecar remains a point of concern even after the earlier patch.
What to watch next
The June sequence is the benchmark: disclosure on June 18, reported exploitation and a CISA listing three days later. Watch whether either vendor changes its exploitation language, and whether CISA lists the SonicWall SSRF or the Patroni bug. The next few days will show whether the October patches hold their quiet, or whether the June pattern repeats. For IT leaders deciding how quickly to move, the June precedent is the data point that justifies urgency even when no one is actively exploiting the flaws yet.
Join the discussion