CVE-2026-76292 Splunk CVE debrief

Who should care

Splunk Enterprise and Splunk Secure Gateway administrators, security teams, and IT personnel responsible for managing user access and authorization should assess exposure and implement necessary mitigations to prevent unauthorized access to mobile alert notification data.

Why it matters

Defenders should care about CVE-2026-76292 because it allows low-privileged users to read mobile alert notification data for other users in Splunk Enterprise and Splunk Secure Gateway. The vulnerability requires verification of exposure in deployments, especially where low-privileged users have access to REST API endpoints. The impact is related to potential unauthorized access to sensitive data and the need to implement proper authorization controls.

• Potential unauthorized access to mobile alert notification data
• Need to verify exposure in Splunk Enterprise and Splunk Secure Gateway deployments
• Requirement to implement role-based access control to enforce user-level authorization
• Possible impact on confidentiality due to missing authorization

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73. A low-privileged user can read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints due to a lack of user-level authorization for read requests.

Defensive priority

Defenders should prioritize verifying exposure in Splunk Enterprise and Splunk Secure Gateway deployments, especially where low-privileged users have access to REST API endpoints.

Recommended defensive actions

• Verify Splunk Enterprise and Splunk Secure Gateway versions and configurations to determine exposure
• Restrict access to REST API endpoints for low-privileged users
• Implement role-based access control to enforce user-level authorization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Splunk Enterprise and Splunk Secure Gateway. The affected versions and configurations are specified, but no information on exploitation or impact is provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.