Security updates are more than routine maintenance. They are a critical line of defense against unauthorized access, privilege escalation, data exposure, and potential system compromise.
Organizations that depend on enterprise monitoring, security orchestration, and IT management platforms should review the latest security advisories from Splunk and SolarWinds and prioritize the applicable patches.
Recent updates from both vendors address multiple vulnerabilities that could affect the confidentiality, integrity, and availability of enterprise systems. The disclosures reinforce the importance of proactive vulnerability management and timely patch deployment.
1. Splunk Addresses Multiple Security Vulnerabilities
Splunk has released security updates for Splunk Enterprise and Splunk SOAR, addressing vulnerabilities in their own code as well as third-party software components.
Splunk Enterprise
The latest Enterprise releases address 16 CVEs in the product’s code, including critical-severity issues involving improper access controls and improper neutralization of input.
Other vulnerabilities addressed include weaknesses associated with:
- Remote code execution, which may allow attackers to execute unauthorized commands.
- Denial-of-service attacks that can affect system availability.
- Authorization bypasses that could enable access beyond intended permissions.
- Resource-control weaknesses that may affect system stability and security.
The updated versions are:
- Splunk Enterprise 9.4.16
- Splunk Enterprise 10.0.11
- Splunk Enterprise 10.2.8
- Splunk Enterprise 10.4.4
Organizations should identify their current versions and upgrade to the appropriate fixed release or a later supported version.
Splunk SOAR
Splunk SOAR version 8.7.0 addresses 15 vulnerabilities in its own code, along with additional vulnerabilities in third-party libraries.
The most severe issues include critical-severity weaknesses related to data exposure and improper access control. Other fixes address information disclosure, input handling, resource management, and security protection mechanisms.
Because security orchestration platforms can connect to multiple systems and automate operational tasks, vulnerabilities in these environments deserve particular attention. An improperly secured automation platform could increase the potential impact of a compromise across connected infrastructure.
2. SolarWinds Fixes Authorization and Information Disclosure Issues
SolarWinds has also released updates for its Observability and Patch Manager products.
One high-severity vulnerability, CVE-2026–28328, affects SolarWinds Observability and involves a broken authorization mechanism. Under certain conditions, a user with limited privileges could gain access to information that should be restricted.
The vendor has also addressed:
- Cross-site scripting (XSS) vulnerabilities in Observability.
- Server-side request forgery (SSRF) vulnerabilities in Observability.
- An information disclosure vulnerability in Patch Manager.
The relevant fixed releases include:
- SolarWinds Observability Self-Hosted 2026.4
- SolarWinds Patch Manager 2026.4
Organizations using these products should confirm their deployment type, review the vendor’s advisory, and apply the appropriate update.
Authorization flaws are especially important because security depends not only on preventing external access, but also on ensuring that authenticated users can access only the resources and functions permitted by their roles.
3. Why These Vulnerabilities Matter to Businesses
Monitoring, automation, and IT management platforms often have visibility into sensitive operational information and connections to other enterprise systems. A weakness in one of these platforms can therefore create risks beyond the individual application.
Potential business impacts include:
Unauthorized access: Weak authorization controls can expose information to users who should not be able to access it.
Operational disruption: Denial-of-service vulnerabilities may interfere with monitoring, automation, or other essential IT functions.
Broader compromise: Remote code execution and security control bypasses can create opportunities for attackers to gain a foothold, depending on the vulnerability and deployment configuration.
Sensitive information exposure: Information disclosure flaws may reveal data that should remain restricted.
Compliance and audit concerns: Unpatched systems can increase exposure to security incidents and make it harder to demonstrate effective vulnerability management and risk treatment.
The actual risk depends on the affected version, configuration, network exposure, privileges required, and available mitigations. Organizations should validate these factors rather than assuming every deployment has identical exposure.
4. Recommended Actions for Security and IT Teams
To reduce exposure, organizations should take a structured approach to remediation.
1. Identify affected assets
Inventory all Splunk Enterprise, Splunk SOAR, SolarWinds Observability, and SolarWinds Patch Manager deployments. Include production, test, development, and disaster recovery environments.
2. Verify versions against official advisories
Compare installed versions with the vendor’s affected-version and fixed-version information. Check for any additional remediation instructions associated with individual CVEs.
3. Prioritize patches according to risk
Address critical and high-severity vulnerabilities first, particularly where exploitation could enable remote code execution, authorization bypass, or sensitive data exposure. Consider external accessibility, business criticality, and existing security controls.
4. Review access permissions
Apply least-privilege principles to user accounts, service accounts, integrations, and administrative roles. Investigate whether users or integrations have access beyond their operational requirements.
5. Test and deploy updates safely
Validate patches in an appropriate environment where feasible, confirm compatibility with integrations, and follow change-management procedures. Ensure backups and rollback plans are available before making production changes.
6. Monitor for suspicious activity
Review application logs, authentication events, administrative actions, unusual requests, and unexpected changes. Investigate suspicious activity, especially around exposed or privileged systems.
7. Validate remediation
After deployment, confirm that the affected systems are running fixed versions and that any additional vendor-prescribed actions have been completed. Record the results for internal audits and compliance evidence.
8. Strengthen vulnerability management processes
Establish clear remediation timelines, maintain accurate asset inventories, assign ownership, and regularly reassess risk. Patch management should be an ongoing security process rather than a response limited to major announcements.
5. Which Industries Should Pay Attention?
These updates are relevant to organizations across multiple sectors:
- Financial services: Protect monitoring systems, operational data, and privileged administrative environments while supporting regulatory risk-management obligations.
- Healthcare: Reduce the risk of operational disruption and unauthorized access to systems supporting clinical and administrative services.
- Retail and e-commerce: Protect IT infrastructure, business operations, and systems that support customer-facing services.
- Manufacturing: Maintain the security and availability of enterprise IT and monitoring environments that support production operations.
- Government and public services: Strengthen access controls, preserve sensitive information, and maintain documented patching and remediation processes.
Organizations using these products should evaluate their own exposure based on their deployed versions, architecture, and security requirements.
Conclusion: Timely Patching Is a Core Security Responsibility
The latest Splunk and SolarWinds updates highlight a fundamental cybersecurity principle: enterprise platforms must be maintained and monitored as carefully as the systems they protect.
Security teams should not wait for evidence of an active attack before reviewing applicable patches. Identifying vulnerable assets, prioritizing remediation, enforcing least privilege, and validating fixes can substantially improve an organization’s security posture.
Effective vulnerability management combines technology, processes, and accountability. By treating security advisories as actionable risk-management signals, organizations can reduce exposure, improve resilience, and support their compliance objectives.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
How COE Security can help: Our cybersecurity services can help organizations assess technical exposure, identify security weaknesses, strengthen access controls, validate remediation, and improve vulnerability management practices across enterprise applications and infrastructure.
Follow COE Security on LinkedIn for practical cybersecurity insights, emerging threat updates, and guidance to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article