CVE-2026-76351

Received Received - Intake

Splunk Enterprise REST API Session Token Exposure via Report Notifications

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76351

EUVD

EUVD-2026-62916

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 9.4.14 (exc)
splunk	splunk_secure_gateway	to 3.8.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. A non-admin user can exploit crafted report notification data to send requests to the Splunk REST API using a system-level session token, modifying the Splunk platform configuration. This allows the user to obtain a session token without a password and access all data or affect system integrity.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, modify system configurations, or disrupt operations. This could lead to data breaches, loss of data integrity, or unauthorized system changes, affecting confidentiality, availability, and integrity of the Splunk platform.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal or sensitive data, violating GDPR and HIPAA requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised data security and integrity.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 and Splunk Secure Gateway to versions 3.10.9, 3.9.23, or 3.8.70 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70