CVE-2026-76265
Improper Access Control through REST API Endpoints in Splunk Secure Gateway
Splunk Splunk EnterpriseApplications & CMS
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.4.3Splunk EnterpriseCVE List
- 10.2.7Splunk EnterpriseCVE List
- 10.0.10Splunk EnterpriseCVE List
- 9.4.15Splunk EnterpriseCVE List
- 3.10.11Splunk Secure GatewayCVE List
- 3.9.25Splunk Secure GatewayCVE List
Show all 7 fixed versions
- 3.8.72Splunk Secure GatewayCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.
Text from CVE List
Affected versions 7
- Splunk Enterpriseaffected: 10.4 before 10.4.3CVE List
- Splunk Enterpriseaffected: 10.2 before 10.2.7CVE List
- Splunk Enterpriseaffected: 10.0 before 10.0.10CVE List
- Splunk Enterpriseaffected: 9.4 before 9.4.15CVE List
- Splunk Secure Gatewayaffected: 3.10 before 3.10.11CVE List
- Splunk Secure Gatewayaffected: 3.9 before 3.9.25CVE List
- Splunk Secure Gatewayaffected: 3.8 before 3.8.72CVE List