Incorrect authorization in Splunk Secure Gateway - CVE-2026-76264
Published: October 12, 2026
Vulnerability identifier: #VU154099
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76264
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create or edit scripted lookup definitions without authorization.
The vulnerability exists due to improper authorization in raw transforms configuration write paths when saving scripted lookup settings. A remote user can submit configuration changes through raw configuration endpoints to create or edit scripted lookup definitions without authorization.
Exploitation does not require the admin or power Splunk roles.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76264
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3