CVE-2026-76347

Received Received - Intake

SSRF in Splunk Enterprise via Report Notifications

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76347

EUVD

EUVD-2026-62912

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)
splunk	splunk_secure_gateway	to 3.8.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) issue in Splunk Enterprise and Splunk Secure Gateway. A non-admin user could exploit it by sending system-authenticated requests to internal Splunk services via report notifications. This could alter the Search Head Cluster state and cause a denial of service.

Detection Guidance

Detection requires checking Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14 and Splunk Secure Gateway versions below 3.10.9, 3.9.23, or 3.8.70. Use Splunk's built-in version check or run commands like 'splunk show version' on the command line to verify installed versions.

Impact Analysis

An attacker could disrupt Splunk operations, modify cluster configurations, or cause service outages. This may lead to data unavailability or unauthorized changes in your Splunk environment.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data or disrupting logging and monitoring systems required by GDPR, HIPAA, or other regulations. Unauthorized changes to Splunk services may also violate audit and data integrity requirements.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 and Splunk Secure Gateway to versions 3.10.9, 3.9.23, or 3.8.70 or later. Remove unnecessary Splunk roles for users and restrict access to internal services.

Hi! I’m here to help you understand CVE-2026-76347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70