CVE-2026-76272

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-07

Last updated on: 2026-10-14

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76272

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.10 (exc)
splunk	splunk	From 10.2.0 (inc) to 10.2.7 (exc)
splunk	splunk	From 10.4.0 (inc) to 10.4.3 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.15 (exc)
splunk	splunk_secure_gateway	From 3.10.0 (inc) to 3.10.11 (exc)
splunk	splunk_secure_gateway	From 3.8.0 (inc) to 3.8.72 (exc)
splunk	splunk_secure_gateway	From 3.9.0 (inc) to 3.9.25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise and Splunk Secure Gateway. A non-admin user can trick the system into signing malicious payloads because it doesn't check if the user is authorized to request signatures. This could allow attackers to forge data or actions within Splunk.

Detection Guidance

This vulnerability can be detected by checking Splunk Enterprise and Splunk Secure Gateway versions. Ensure Splunk Enterprise is updated to at least 10.4.3, 10.2.7, 10.0.10, or 9.4.15, and Splunk Secure Gateway to at least 3.10.11, 3.9.25, or 3.8.72. Review user roles to confirm no non-admin or non-power users have access to Splunk Secure Gateway signature requests.

Impact Analysis

An attacker could exploit this to sign unauthorized payloads, potentially leading to data manipulation, unauthorized access, or other malicious activities within your Splunk environment. This could compromise data integrity and system security.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, loss of audit trails, and failure to meet security controls.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later. Also upgrade Splunk Secure Gateway to versions 3.10.11, 3.9.25, or 3.8.72 or later to address the issue.

Hi! I’m here to help you understand CVE-2026-76272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70