Incorrect permission assignment for critical resource in Splunk Secure Gateway - CVE-2026-76280
Published: October 12, 2026
Vulnerability identifier: #VU154115
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76280
CWE-ID: CWE-732
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify Splunk Secure Gateway alert and mobile-device recipient data without authorization.
The vulnerability exists due to incorrect permission assignment in Splunk Secure Gateway App KV Store collections when allowing unrestricted writes instead of limiting them to authorized workflows. A remote user can write to the affected collections to modify Splunk Secure Gateway alert and mobile-device recipient data without authorization.
The data is subsequently used by alert and subscription workflows. Exploitation does not require the admin or sc_admin Splunk roles.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76280
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3