CVE-2026-76280

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway versions prior to 3.9.25 Splunk Secure Gateway versions prior to 3.8.72

Description An authenticated user without the admin or sc admin roles can modify alert and mobile-device recipient data within App Key Value Store (KV Store) collections. This is possible because the affected collections allow unrestricted write access instead of limiting modifications to authorized Splunk Secure Gateway workflows. These modified collections are subsequently used by alert and subscription workflows.

Recommendations Update Splunk Enterprise to version 10.4.3 or later. Update Splunk Enterprise to version 10.2.7 or later. Update Splunk Enterprise to version 10.0.10 or later. Update Splunk Enterprise to version 9.4.15 or later. Update Splunk Secure Gateway to version 3.10.11 or later. Update Splunk Secure Gateway to version 3.9.25 or later. Update Splunk Secure Gateway to version 3.8.72 or later.