Three Secure Gateway authorization findings in one Splunk batch: 76265, 76272 and 76280
Splunk published SVD-2026-1001 on 2026-10-07. Reading it end to end matters, because CVE-2026-76272 shares an app and a root cause pattern with two higher-scoring neighbours.
What Splunk shipped
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10 and 9.4.15 carry the fixes. Splunk Secure Gateway versions 3.10.11, 3.9.25 and 3.8.72 carry its own.
The three findings
CVE-2026-76272 is missing access control through the REST API in Splunk Secure Gateway, mapped to CWE-862 and scored 4.3 under CVSSv3.1. Splunk records it as VULN-71728. An account without the admin or power roles can make the gateway sign payloads the account controls.
CVE-2026-76265 is improper access control through REST API endpoints in Splunk Secure Gateway, mapped to CWE-284 and scored 6.5. Splunk notes there that privileged gateway functionality can be reached by accounts that should not have it.
CVE-2026-76280 is incorrect permission assignment for App Key Value Store collections in Splunk Secure Gateway, mapped to CWE-732 and scored 6.3. Alert and mobile-recipient data in those collections can be changed by an authenticated account without the admin or sc_admin roles.
Why the cluster matters
All three sit in the same application and all three are authorization defects, which points at a surface that needed hardening rather than a single slip. Two of them touch signing and recipient data that other workflows consume.
Affected versions and scope
Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10 and 9.4.15, plus Splunk Secure Gateway below 3.10.11, 3.9.25 and 3.8.72. Where the app is not used, the advisory permits turning it off or removing it, noting that Splunk Mobile, Spacebridge and Mission Control depend on it.
Exposure context
ZoomEye returns 47,639 instances for app="Splunk". Use it to size how much Splunk faces the internet, not to count affected gateways.
Remediation
Upgrade both products to the fixed releases, or remove the app where its features are not in use.
Top comments (0)