CVE-2026-76265
6.5 MEDIUMPublished 2026-10-07 · Updated 2026-10-09
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2023-54412PoC
- CRITICALCVE-2024-34320
- HIGHCVE-2025-70962PoC
- HIGHCVE-2026-100114
- HIGHCVE-2026-100115
- MEDIUMCVE-2026-100621PoC
- CRITICALCVE-2026-100758
- MEDIUMCVE-2026-100883PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.