Splunk security advisory (AV26-493) – Canadian Centre for Cyber Security

Serial number: AV26-493
Date: May 20, 2026

On May 20, 2026, Splunk published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:

• Splunk User Behavior Analytics – versions prior to 5.4.5
• Splunk AppDynamics Machine Agent – versions prior to 26.4.0
• Splunk AppDynamics Java Agent – versions prior to 26.4.0
• Splunk AppDynamics Private Synthetic Agent – versions prior to 26.4.0
• Splunk AppDynamics Python Agent – versions prior to 26.4.1
• Splunk AppDynamics Cluster Agent – versions prior to 26.4.0
• Splunk AppDynamics Database Agent – versions prior to 26.4.0
• Splunk AppDynamics Analytics Agent – versions prior to 26.4.0
• Splunk AppDynamics Apache Web Server Agent – versions prior to 25.11.1
• Splunk Universal Forwarder – versions 9.4.0 to 9.4.10
• Splunk Enterprise – multiple versions and platforms
• Splunk Cloud Platform – multiple versions and platforms
• Splunk AI Toolkit – versions prior to 5.7.3

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.