CVE-2026-76257

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway versions prior to 3.9.24 Splunk Secure Gateway versions prior to 3.8.71

Description A user with a Splunk role permitted to list storage passwords, but lacking Splunk Secure Gateway administration privileges, can access Mobile Device Management signing secrets. This compromise affects the trust of all mobile-device enrollments through Splunk Secure Gateway. The issue occurs because the Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language (SAML) setup, and companion app workflows do not enforce Splunk Secure Gateway administration privileges before processing requests.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.10 or later. Update Splunk Secure Gateway to version 3.9.24 or later. Update Splunk Secure Gateway to version 3.8.71 or later.