CVE-2026-76280 Splunk CVE debrief

Who should care

Splunk Enterprise and Splunk Secure Gateway administrators, security teams, and IT personnel responsible for managing user access and role-based permissions. These stakeholders should verify exposure, prioritize remediation, and implement compensating controls to mitigate potential disruptions to alert and subscription workflows.

Why it matters

CVE-2026-76280 allows an authenticated user to modify sensitive data in Splunk Secure Gateway, potentially disrupting workflows. Defenders should verify exposure, restrict write access, and implement role-based access control.

• Potential unauthorized modification of alert and mobile-device recipient data
• Possible disruption of alert and subscription workflows
• Need for verification of user access and role-based permissions
• Priority for remediation and compensating controls

Technical summary

CVE-2026-76280 is a vulnerability in Splunk Enterprise and Splunk Secure Gateway that allows an authenticated user to modify alert and mobile-device recipient data in App Key Value Store collections. The vulnerability exists due to unrestricted write access to affected collections. This could potentially disrupt workflows. The affected versions are Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72. Defenders should verify exposure, restrict write access, and implement role-based access control.

Defensive priority

Splunk Enterprise and Splunk Secure Gateway administrators should verify exposure and prioritize remediation.

Recommended defensive actions

• Verify Splunk Enterprise and Splunk Secure Gateway versions for exposure
• Restrict write access to App Key Value Store collections
• Implement role-based access control for Splunk Secure Gateway workflows
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Splunk Enterprise and Splunk Secure Gateway. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.