Is CVE-2026-76292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76292 being exploited in the wild.

How severe is CVE-2026-76292?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Which products and versions are affected?

Splunk Secure Gateway below 3.10.12, 3.9.26, and 3.8.7; Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.

Is there a fix for CVE-2026-76292?

Yes: fixed in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16; Splunk Secure Gateway 3.10.12, 3.9.26, and 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76292 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76292?

Check whether you run Splunk Secure Gateway or Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76292: Splunk Enterprise missing authorization through REST API endpoints

CVE-2026-76292 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Splunk Enterprise and Secure Gateway, which provide data analytics and secure network connectivity, contain an authorization bypass vulnerability in REST API endpoints. A low-privileged user without administrative rights can read mobile alert notification data intended for other users, potentially exposing sensitive alert information and communications.

Technologies: Splunk Secure Gateway, Splunk Enterprise. Vendors: Splunk.

Quick answers

Is CVE-2026-76292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76292 being exploited in the wild.
How severe is CVE-2026-76292?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: Splunk Secure Gateway below 3.10.12, 3.9.26, and 3.8.7; Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
Is there a fix for CVE-2026-76292?: Yes: fixed in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16; Splunk Secure Gateway 3.10.12, 3.9.26, and 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76292 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76292?: Check whether you run Splunk Secure Gateway or Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16; Splunk Secure Gateway 3.10.12, 3.9.26, and 3.8.7

Technical details

CVE-2026-76292 is a missing authorization vulnerability (CWE-862) in the Key Value Store (KV Store) REST API endpoints of Splunk Secure Gateway. The affected endpoints do not enforce user-level authorization checks for read requests, allowing any authenticated user to access data belonging to other users. The vulnerability requires an authenticated attacker and affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, as well as Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.7.

Affected products

Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16
Splunk Secure Gateway below 3.10.12, 3.9.26, and 3.8.7

Timeline

2026-10-21: disclosed

References

https://advisory.splunk.com/advisories/SVD-2026-1007

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.