CVE-2026-76280 in Splunk
Summary
by MITRE • 10/07/2026
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use. The vulnerability is possible because the affected collections allow unrestricted write access instead of limiting writes to authorized Splunk Secure Gateway workflows. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store), KV store endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/kv-store-endpoints/kv-store-endpoint-descriptions), and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability represents a critical authorization flaw within Splunk Enterprise and Splunk Secure Gateway environments, specifically affecting versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 for the enterprise platform, as well as versions below 3.10.11, 3.9.25, and 3.8.72 for Secure Gateway. This issue stems from an improper implementation of access controls on specific App Key Value Store collections that are integral to the alerting and mobile-device notification subsystems. The core technical deficiency lies in the configuration of these KV store collections, which permit unrestricted write operations by any authenticated user who lacks administrative privileges or specialized security administration roles such as sc_admin. In a properly secured environment, data structures used for operational workflows should be restricted to only those processes explicitly authorized to modify them, ensuring that end-users cannot interfere with system-critical configurations through standard API endpoints.
From an offensive perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, and more specifically reflects the characteristics of CWE-732, where a component operates at a higher privilege level than necessary for its function. An attacker who has obtained valid credentials to any non-administrative account within the Splunk instance can exploit this misconfiguration to alter alert definitions and mobile-device recipient lists stored in the KV store. By modifying these data collections directly via REST API calls, an adversary can effectively hijack the notification infrastructure of the platform. This capability allows for significant disruption of security operations by preventing legitimate alerts from reaching administrators or redirecting them to attacker-controlled endpoints.
The operational impact of this vulnerability is severe and multifaceted. First, it enables a denial-of-service condition against critical alerting mechanisms. By deleting or corrupting recipient data in the KV store, an insider threat or external actor can silence security notifications regarding active threats, breaches, or system anomalies. This blindness allows malicious activities to proceed undetected for extended periods. Second, the vulnerability facilitates potential phishing and social engineering attacks by allowing the attacker to modify mobile-device recipient information. If an attacker can redirect alerts to a device they control, they may intercept sensitive operational data or manipulate alert content before it reaches legitimate administrators, thereby undermining trust in the security monitoring infrastructure. Furthermore, this flaw undermines the principle of least privilege, as standard users are granted write access to system-critical configuration stores that should be immutable by non-privileged entities.
This vulnerability also intersects with MITRE ATT&CK techniques related to Defense Evasion and Impact. Specifically, it relates to T1562, Impair Defenses, where an adversary disables or modifies security tools to avoid detection. By altering the alerting configuration stored in the KV store, the attacker effectively blinds the Security Information and Event Management (SIEM) system's notification layer. Additionally, if the modified recipient data includes email addresses or mobile numbers controlled by the attacker, it could facilitate T1534, Internal Spearphishing, as alerts containing sensitive information might be routed to compromised accounts for further exploitation. The ability to modify these collections without elevation of privilege makes this a high-risk issue that requires immediate remediation through software updates and strict review of KV store permissions in existing deployments.
To mitigate the risks associated with this vulnerability, organizations must upgrade Splunk Enterprise to version 10.4.3 or later, 10.2.7, 10.0.10, or 9.4.15, and update Splunk Secure Gateway to versions 3.10.11, 3.9.25, or 3.8.72 as soon as possible. These releases contain the necessary patches that enforce proper access controls on the affected KV store collections, ensuring that only authorized workflows can write to them. For environments where immediate patching is not feasible due to operational constraints, administrators should implement network-level restrictions to limit API access from untrusted sources and rigorously audit user roles to ensure no non-administrative users have unnecessary permissions over alert configuration endpoints. Regular reviews of KV store collection permissions against the principle of least privilege are essential to prevent similar authorization flaws in other system components.