Signals
Back to database
Schedule36Medium6.5VulnerabilityCVE-2026-76265No patch link observed

CVE-2026-76265 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a us…

Published Oct 7, 2026, 09:17 PM UTCIngested 1d agoSource NVD(cve-db)CVE-2026-76265

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.

CVSS v3.1 base metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Network

Attack Vector

AC

Low

Attack Complexity

PR

Low

Privileges Required

UI

None

User Interaction

S

Unchanged

Scope

C

High

Confidentiality

I

None

Integrity

A

None

Availability

References

Related threats

same CWE or vendor
Low

CVE-2026-105823 — ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be …

CVE-2026-105823 · 9h ago

Critical

CVE-2026-107510 — An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

CVE-2026-107510 · 14h ago

Medium

CVE-2026-76281 — Improper Access Control.

CVE-2026-76281 · 1d ago

Critical

CVE-2026-76498 — As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engi…

CVE-2026-76498 · 1d ago

High

CVE-2026-76463 — As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensiv…

CVE-2026-76463 · 1d ago

Critical

CVE-2026-76455 — As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive int…

CVE-2026-76455 · 1d ago