CVE-2026-76265: splunk Improper Access Control
Vulnerability summary
CVE-2026-76265 is a medium (CVSS 6.5) Improper Access Control vulnerability in splunk. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.
Timeline
- 07-10-2026PublishedVulnerability first disclosed.
- 09-10-2026Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 9.4.0, < 9.4.15 | ≥ 10.0.0, < 10.0.10 | ≥ 10.2.0, < 10.2.7 | ≥ 10.4.0, < 10.4.3
- splunk enterprise≥ 10.4, < 10.4.3 | ≥ 10.2, < 10.2.7 | ≥ 10.0, < 10.0.10 | ≥ 9.4, < 9.4.15
- splunk_secure_gateway≥ 3.10, < 3.10.11 | ≥ 3.9, < 3.9.25 | ≥ 3.8, < 3.8.72 | ≥ 3.8.0, < 3.8.72 | ≥ 3.9.0, < 3.9.25 | ≥ 3.10.0, < 3.10.11
1 vendor · 3 products
References
1 links- advisory.splunk.com/advisories/SVD-2026-1001Vendor Advisory