What’s Vulnerable › Vulnerabilities

CVE-2026-76265: Improper Access Control through REST API Endpoints in Splunk Secure Gateway

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-14
• Weakness: CWE-284

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.

Affected products

• Splunk Enterprise: from 9.4.0 before 9.4.15; from 10.0.0 before 10.0.10; from 10.2.0 before 10.2.7; from 10.4.0 before 10.4.3 — fixed in 10.0.10, 10.2.7, 10.4.3, 9.4.15
• Splunk Secure Gateway: from 3.8.0 before 3.8.72; from 3.9.0 before 3.9.25; from 3.10.0 before 3.10.11 — fixed in 3.10.11, 3.8.72, 3.9.25

How to fix

Upgrade to a fixed version: Splunk Enterprise 10.0.10, 10.2.7, 10.4.3, 9.4.15; Splunk Secure Gateway 3.10.11, 3.8.72, 3.9.25. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2026-1001

Get alerted when CVE-2026-76265 or the next vulnerability affects your stack