CVE-2026-76257
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 22:17:13.670000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-76257",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T22:17:13.670",
"lastModified": "2026-10-26T10:10:00.140",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 10.4.2, 10.2.6, 10.0.9 y 9.4.14, y en las versiones de Splunk Secure Gateway anteriores a 3.10.10, 3.9.24 y 3.8.71, un usuario que posee un rol de Splunk con permisos para listar contraseñas de almacenamiento pero no posee privilegios de administración de Splunk Secure Gateway podría acceder a secretos de firma de Mobile Device Management que comprometen toda la confianza de inscripción de dispositivos móviles afectados a través de Splunk Secure Gateway. La vulnerabilidad es posible porque los puntos finales de la API (Representational State Transfer) REST de Splunk Secure Gateway para el paquete de implementación, la configuración de Security Assertion Markup Language y los flujos de trabajo de la aplicación complementaria no requieren privilegios de administración de Splunk Secure Gateway antes de procesar las solicitudes."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"modules": [
"Splunk Secure Gateway"
],
"versions": [
{
"version": "10.4",
"lessThan": "10.4.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2",
"lessThan": "10.2.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Secure Gateway",
"versions": [
{
"version": "3.10",
"lessThan": "3.10.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.9",
"lessThan": "3.9.24",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.8",
"lessThan": "3.8.71",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-26T14:49:08.470513Z",
"id": "CVE-2026-76257",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.14",
"matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.9",
"matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.6",
"matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.4.0",
"versionEndExcluding": "10.4.2",
"matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8.0",
"versionEndExcluding": "3.8.71",
"matchCriteriaId": "B30F23F9-3337-4DE3-8F91-B9B54EC5CA19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.0",
"versionEndExcluding": "3.9.24",
"matchCriteriaId": "05B1F48C-70F7-4455-9BE9-613943727644"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.0",
"versionEndExcluding": "3.10.10",
"matchCriteriaId": "48361782-396C-4DBD-96BF-0131DF4D5DF4"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}