CVE-2026-76257: splunk Missing Authorization
Vulnerability summary
CVE-2026-76257 is a medium (CVSS 6.5) Missing Authorization vulnerability in splunk. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26% of scored vulnerabilities.
Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 26-08-2026Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
+0.09 pp
From 0.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 9.4.0, < 9.4.14 | ≥ 10.0.0, < 10.0.9 | ≥ 10.2.0, < 10.2.6 | ≥ 10.4.0, < 10.4.2
- splunk enterprise≥ 10.4, < 10.4.2 | ≥ 10.2, < 10.2.6 | ≥ 10.0, < 10.0.9 | ≥ 9.4, < 9.4.14
- splunk_secure_gateway≥ 3.10, < 3.10.10 | ≥ 3.9, < 3.9.24 | ≥ 3.8, < 3.8.71 | ≥ 3.8.0, < 3.8.71 | ≥ 3.9.0, < 3.9.24 | ≥ 3.10.0, < 3.10.10
1 vendor · 3 products
References
1 links- advisory.splunk.com/advisories/SVD-2026-0801Vendor Advisory