CVE-2026-76351: Splunk Enterprise privilege escalation via report notification data

CVE-2026-76351 · Severity: high · CVSS 8.8 · Published 2026-08-19

Splunk Enterprise is a widely deployed data analytics platform used by organizations to search, analyze, and visualize machine-generated data. An unprivileged user can exploit a validation flaw in report notification handling to inject crafted data that causes Splunk Secure Gateway to make unauthorized REST API requests with system-level privileges. This allows the attacker to modify platform configuration, obtain passwordless session tokens, and access all data or compromise system integrity.

Technologies: Splunk Secure Gateway. Vendors: Splunk.

Quick answers

Is CVE-2026-76351 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76351 being exploited in the wild.
How severe is CVE-2026-76351?
High severity, with a CVSS score of 8.8, published 19 August 2026.
Which products and versions are affected?
Splunk Secure Gateway before 3.10.9, 3.9.23, and 3.8.70.
Is there a fix for CVE-2026-76351?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76351 attacked?
It is attacked over the network.
Am I affected by CVE-2026-76351?
Check whether you run Splunk Secure Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a privilege escalation vulnerability (CWE-269/CWE-862) in Splunk Enterprise and Splunk Secure Gateway caused by insufficient validation of decoded report notification identifiers. An unauthenticated or low-privilege user can craft malicious report notification data that, when processed by Splunk Secure Gateway, results in unauthorized REST API requests to Splunk Enterprise using a system-level session token. The attacker can then modify platform configuration, bypass authentication to obtain session tokens without credentials, and access sensitive data. The vulnerability requires no network access beyond what is normally available to users and can be exploited without prior authentication as a privileged user. Patches are available in Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, 9.4.14 and Splunk Secure Gateway 3.10.9, 3.9.23, 3.8.70.

Affected products

  • Splunk Enterprise 10.4.0–10.4.1, 10.2.0–10.2.5, 10.0.0–10.0.8, 9.4.0–9.4.13
  • Splunk Secure Gateway before 3.10.9, 3.9.23, and 3.8.70

Timeline

  • 2026-08-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.