CVE-2026-76257

Received Received - Intake

Privilege Escalation in Splunk Secure Gateway

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76257

EUVD

EUVD-2026-63109

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.4.2 (exc)
splunk	splunk_enterprise	to 10.2.6 (exc)
splunk	splunk_enterprise	to 10.0.9 (exc)
splunk	splunk_enterprise	to 9.4.14 (exc)
splunk	splunk_secure_gateway	to 3.10.10 (exc)
splunk	splunk_secure_gateway	to 3.9.24 (exc)
splunk	splunk_secure_gateway	to 3.8.71 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise and Splunk Secure Gateway. A user with limited permissions (ability to list storage passwords but no admin rights for Splunk Secure Gateway) can access Mobile Device Management signing secrets. This happens because certain REST API endpoints in Splunk Secure Gateway do not require admin privileges before processing requests, allowing unauthorized access to sensitive secrets that could compromise mobile device enrollment trust.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain access to Mobile Device Management signing secrets. This could lead to unauthorized control over mobile device enrollments, potentially allowing attackers to install malicious software, intercept communications, or gain access to sensitive data managed through these devices.

Compliance Impact

This vulnerability could lead to unauthorized access to Mobile Device Management signing secrets, potentially compromising mobile device enrollment trust. Such access may violate data protection requirements under GDPR or HIPAA if it results in unauthorized exposure of sensitive data or device management controls.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14, and Splunk Secure Gateway to versions 3.10.10, 3.9.24, or 3.8.71 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70