CVE-2026-76265
Splunk: access control flaw
- Risk score
- 42/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure G…
- Affected
- Splunk
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Splunk: Amber, patch this week. In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible bec…
The flaws
- CVE-2026-76265: Access control flaw (CVSS 6.5 · EPSS 0%)
- CVE-2026-76268: Missing authentication (CVSS 9.8 · EPSS 2%)
- CVE-2026-76284: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
- CVE-2026-76285: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Splunk
Where it stands
- No known exploitation
Connects to
- Same weakness: Access control flaw (CWE-284). 325 other warnings in 30 days
- Same product: Earlier Splunk warnings. 18 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.
Last activity 7 Oct 2026. Patch Forecast updates every hour.