CVE-2026-76351

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway versions prior to 3.9.23 Splunk Secure Gateway versions prior to 3.8.70

Description Users without admin or power roles can use crafted report notification data to force Splunk Secure Gateway to send requests to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token. This allows the modification of the Splunk platform configuration, enabling the user to obtain a session token without a password to access sensitive data and compromise system integrity. The issue occurs because Splunk Secure Gateway fails to validate decoded report notification identifiers before using them to construct requests to the REST API.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.9 or later. Update Splunk Secure Gateway to version 3.9.23 or later. Update Splunk Secure Gateway to version 3.8.70 or later.