{"schema":"threatline.record/2","record":{"id":"CVE-2026-76265","aliases":[],"summary":"Improper Access Control through REST API Endpoints in Splunk Secure Gateway","details":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the \"admin\" or \"power\" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.","categories":["Applications & CMS"],"product":"Splunk Enterprise","vendor":"Splunk","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Splunk Enterprise","vendor":"Splunk","versions":[{"version":"10.4","status":"affected","versionType":"custom","lessThan":"10.4.3"},{"version":"10.2","status":"affected","versionType":"custom","lessThan":"10.2.7"},{"version":"10.0","status":"affected","versionType":"custom","lessThan":"10.0.10"},{"version":"9.4","status":"affected","versionType":"custom","lessThan":"9.4.15"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Splunk Secure Gateway","vendor":"Splunk","versions":[{"version":"3.10","status":"affected","versionType":"custom","lessThan":"3.10.11"},{"version":"3.9","status":"affected","versionType":"custom","lessThan":"3.9.25"},{"version":"3.8","status":"affected","versionType":"custom","lessThan":"3.8.72"}],"defaultStatus":null}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Enterprise","ecosystem":null},"version":"10.4.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Enterprise","ecosystem":null},"version":"10.2.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Enterprise","ecosystem":null},"version":"10.0.10","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Enterprise","ecosystem":null},"version":"9.4.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Secure Gateway","ecosystem":null},"version":"3.10.11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Secure Gateway","ecosystem":null},"version":"3.9.25","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","source_modified_at":"2026-10-09T16:48:13.063Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Splunk Secure Gateway","ecosystem":null},"version":"3.8.72","basis":"first unaffected version stated in the CVE record"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00234,"percentile":0.1356,"score_date":"2026-10-23"},"published_at":"2026-10-07T20:46:29.253Z","modified_at":"2026-10-09T16:48:13.063Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-76265","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T16:48:13.063Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76265","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://advisory.splunk.com/advisories/SVD-2026-1001"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-09T16:15:44.810336Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-09T16:48:13.063Z","content_hash":"8ae70454090ea106902e434d191901a2bab656175fd5626f889afc92dc47398a"}}