# CVE-2026-76347: Splunk Enterprise SSRF in report notifications

Source: https://junglewise.ai/threats/cve-2026-76347-splunk-enterprise-ssrf-in-report-notifications  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76347 · Severity: medium · CVSS 5.4 · Published 2026-08-19

Splunk Enterprise and Secure Gateway contain a Server-Side Request Forgery vulnerability in their report notification system that allows non-admin users to send authenticated requests to internal Splunk services. An attacker could exploit this to modify Search Head Cluster state or trigger denial-of-service conditions, compromising the availability and integrity of Splunk deployments.

Technologies: [Splunk Secure Gateway](https://junglewise.ai/threats/technologies/secure-gateway). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76347 being exploited in the wild.

**How severe is CVE-2026-76347?** Medium severity, with a CVSS score of 5.4, published 19 August 2026.

**Which products and versions are affected?** Splunk Secure Gateway before 3.10.9, 3.9.23, 3.8.70.

**Is there a fix for CVE-2026-76347?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76347 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76347?** Check whether you run Splunk Secure Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76347 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Enterprise and Secure Gateway's report notification functionality. The root cause is insufficient validation of report notification path values before sending internal authenticated requests. An unauthenticated or low-privileged user (without "admin" or "power" roles) can craft malicious notification paths to send system-authenticated requests to internal Splunk services, potentially modifying Search Head Cluster state or causing denial of service. The vulnerability affects Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions before 3.10.9, 3.9.23, and 3.8.70. Patches are available in the fixed versions.

## Affected products

- Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, 9.4.14
- Splunk Secure Gateway before 3.10.9, 3.9.23, 3.8.70

## Timeline

- 2026-08-19: disclosed

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0801](https://advisory.splunk.com/advisories/SVD-2026-0801)

## Related threats

- [Splunk Enterprise SPL injection in REST API through Secure Gateway](https://junglewise.ai/threats/cve-2026-76295-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4)
- [Splunk Enterprise missing authorization through REST API endpoints](https://junglewise.ai/threats/cve-2026-76292-in-splunk-enterprise-versions-below-10-4-4-10-2-8-10-0-11-and-9-4)
- [Splunk Enterprise privilege escalation via report notification data](https://junglewise.ai/threats/cve-2026-76351-splunk-enterprise-privilege-escalation-via-report-notification)
- [Splunk Secure Gateway unsafe deserialization remote code execution](https://junglewise.ai/threats/cve-2026-20251-splunk-secure-gateway-unsafe-deserialization-remote-code)