Improper privilege management in Splunk Secure Gateway - CVE-2026-76266
Published: October 12, 2026
Vulnerability identifier: #VU154101
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76266
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to execute arbitrary operating-system commands with root privileges.
The vulnerability exists due to improper privilege management in the Linux package maintainer script when performing upgrade operations with root privileges while trusting existing installation content. A local privileged user can modify the Splunk Enterprise installation before an affected Linux package upgrade to execute arbitrary operating-system commands with root privileges.
Exploitation requires the ability to run commands as the account running Splunk Enterprise and a subsequent package upgrade initiated through user interaction. Privileges cannot be elevated at will.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76266
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3