CVE-2026-76265

Executive Summary

CVE-2026-76265 is an improper access control vulnerability (CWE-284) affecting Splunk Enterprise and the bundled Splunk Secure Gateway component. A low-privileged authenticated user who does not hold the "admin" or "power" Splunk roles can reach privileged Splunk Secure Gateway REST API endpoints that fail to enforce authorization checks before processing requests. Successful exploitation allows the attacker to cause Splunk Secure Gateway to sign attacker-controlled payloads, undermining the trust chain of mobile and connected-app communications. With a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and an EPSS score of 0.00234 (13.2th percentile), the vulnerability requires authenticated access but yields high confidentiality impact through unauthorized cryptographic signing of arbitrary data.

Technical Analysis

The root cause is a broken authorization control within multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints. Splunk Secure Gateway is the component that brokers communications between Splunk Enterprise/Cloud deployments and mobile clients, providing a registration and messaging path that relies on signed payloads to establish authenticity.

Under normal operating conditions these REST endpoints should validate the caller's Splunk role and reject any request that does not originate from a user holding the "admin" or "power" role. Instead, the affected versions process requests without first performing that role-based authorization check. The flaw is therefore not a memory-safety issue, not an injection flaw, and not an authentication bypass — the attacker must first be an authenticated Splunk user. The vulnerability lies purely in missing function-level access control: the endpoint executes its privileged logic (in this case, invoking the signing operation) regardless of the privileges associated with the session.

Because the affected functionality is a signing service, the confidentiality impact is the primary concern. Any principal able to reach the endpoint can cause the gateway to produce a signature over data the attacker supplies. That signature is created with the gateway's own signing key material, meaning the resulting artifact is indistinguishable from a legitimately-signed payload. The CVSS subscore C:H reflects this: the attacker obtains a cryptographic capability that leaks trust, even though no data is directly modified (I:N) and availability is untouched (A:N).

No specific endpoint paths, parameter names, or function identifiers are available in the NVD description, so the exact REST routes cannot be enumerated. Analysis is limited to the behavior stated by the vendor: multiple endpoints lack authorization enforcement prior to processing.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker first needs a foothold as an authenticated Splunk user. They will locate exposed Splunk Enterprise management interfaces — typically Splunk Web on TCP/8000 or the Splunk REST API on TCP/8089 — using Shodan-style HTTP title and certificate fingerprints. Any account, including a low-privilege one that does not hold "admin" or "power", satisfies the prerequisite.

2. Triggering the flaw class. Once authenticated, the attacker sends requests to the Splunk Secure Gateway REST API endpoints. Because the endpoints do not enforce authorization requirements before processing requests, the request is handled even though the session lacks the required role. The vulnerability class here is missing function-level access control (CWE-284) — the attacker does not need to escalate privileges through an exploit, they simply call a privileged function that never checks them.

3. Payload / execution method. The attacker crafts a request whose body contains attacker-controlled content. The gateway, acting on the request, signs that content. The exact request shape is not documented in the available data; no public PoC, exploit code, or Nuclei template exists, so the attack chain is inferred from the vulnerability class and the vendor's description of the signing behavior. No specific parameter names or endpoint paths are known and none are fabricated here.

4. Post-exploitation impact. The attacker now possesses a valid signature over data they chose. Depending on how that signature is consumed downstream — by mobile clients, by connected apps, or by other components that trust signatures produced by Splunk Secure Gateway — the attacker may be able to impersonate the gateway or inject trusted-looking content into signed communication flows. This is a trust-subversion primitive rather than direct code execution. There is no integrity or availability impact registered in the CVSS vector, so the immediate measurable loss is confidentiality: access to a signing capability that should have been restricted.

Impact Assessment

Business impact centers on the erosion of a cryptographic trust boundary. Splunk Secure Gateway exists to sign data exchanged with mobile and connected endpoints; if arbitrary users can invoke that signing function, downstream systems that treat gateway-signed payloads as authoritative can be deceived. The CVSS environmental reality is a 6.5 MEDIUM base score with AV:N (network reachable), AC:L (no special conditions), PR:L (requires a low-privileged authenticated account), UI:N (no user interaction), S:U (impact scoped to the vulnerable component), C:H (high confidentiality loss), I:N, A:N.

The blast radius spans Splunk Enterprise deployments below the fixed release levels and any environment running the affected Splunk Secure Gateway builds. Because exploitation requires a valid account, the vulnerability is primarily an insider-risk, lateral-movement, and post-compromise amplifier: an attacker who has already landed any Splunk credential can convert that weak foothold into a cryptographic signing capability. Contrast this with an unauthenticated RCE — CVE-2026-76265 is not that, and it is not listed in CISA KEV, has no public exploit, and shows a low EPSS score, indicating no observed mass exploitation at the time of writing. That does not reduce its value in a targeted intrusion where trust in gateway-signed data is the objective.

Detection Guidance

Sigma Rule

title: Suspicious Splunk Secure Gateway REST API Access by Low-Privilege User
id: 8f3c1a44-7626-4d5e-9c01-splunk76426
status: experimental
description: Detects requests to Splunk Secure Gateway REST endpoints from sessions not holding admin or power roles, potentially abusing CVE-2026-76265.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76265
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1078
logsource:
  product: splunk
  service: audit
detection:
  selection_endpoint:
    uri|contains:
      - '/services/securegateway'
      - '/services/messaging'
  selection_role:
    user_role:
      - 'user'
      - 'unknown'
  condition: selection_endpoint and selection_role
falsepositives:
  - Legitimate administrative activity from delegated accounts
  - Automated scripts authenticated as service accounts
level: medium

YARA Rule

rule CVE_2026_76265_SecureGateway_Signing_Abuse
{
    meta:
        description = "Detects artifacts referencing Splunk Secure Gateway signing abuse (CVE-2026-76265)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76265"
        severity = "medium"

    strings:
        $sg1 = "securegateway" ascii nocase
        $sg2 = "Secure Gateway" ascii nocase
        $endpoint = "/services/" ascii
        $sign1 = "sign" ascii nocase
        $role1 = "power" ascii nocase

    condition:
        filesize < 5MB and
        (($sg1 or $sg2) and $endpoint and ($sign1 or $role1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76265 Possible Splunk Secure Gateway Unauthorized Signing Endpoint Access"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/services/"; content:"securegateway"; nocase; http.header; content:"Authorization"; nocase; classtype:attempted-user; reference:cve,2026-76265; sid:202676265; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [authentication where event.category == "authentication" and event.outcome == "success"]
  [http where url.path : "*securegateway*" and http.request.method == "POST" and user.roles : ("user", "unknown")]

Splunk SPL Query

index=_audit action=request
| search uri="*securegateway*" OR uri="*services/messaging*"
| eval endpoint=uri
| join user, endpoint
    [ search index=_audit action=request
      | stats values(roles) as roles by user ]
| where NOT match(roles, "admin") AND NOT match(roles, "power")
| table _time, user, roles, endpoint, clientip, status
| sort -_time

Wazuh OSSEC Rule

<group name="splunk,web,cve-2026-76265">
  <rule id="100765" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri">securegateway</field>
    <field name="http_method">POST</field>
    <field name="role" negate="yes">admin</field>
    <description>CVE-2026-76265: Unauthorized Splunk Secure Gateway REST API access by low-privilege user</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control,pci_dss_10.2.2,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to Splunk management and REST interfaces (TCP/8089) to trusted management networks only. Enforce strict RBAC on all Splunk accounts and remove or disable unnecessary accounts; never grant the "user" role to accounts that do not require it. Monitor and alert on any requests to Splunk Secure Gateway REST API endpoints originating from sessions that do not hold the "admin" or "power" role. Since the vulnerability specifically concerns signing functionality, review any downstream systems that trust Splunk Secure Gateway signatures and evaluate whether signature validation can additionally be pinned or constrained.

2. Patch/upgrade steps. The vendor lists fixed versions as Splunk Enterprise 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway 3.10.11, 3.9.25, and 3.8.72. Upgrade to or above these versions as soon as verified vendor binaries are available. No workaround has been published and no patch source is currently tracked, so administrators should treat any "known-fixed" designation as vendor-stated rather than independently confirmed and validate after upgrade.

3. Long-term hardening. Adopt a least-privilege model for Splunk roles and audit role assignments regularly. Enforce authorization checks at the API gateway layer for all Splunk REST endpoints as defense in depth. Rotate signing keys used by Splunk Secure Gateway after any suspected exploitation, because a signature produced under attacker control may survive patching of the vulnerable code. Monitor for anomalous signing operations and integrate REST API access logs into the SOC's behavioral analytics.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76265
• Splunk Security Advisories: https://advisory.splunk.com/
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• EPSS score data: https://www.first.org/epss/ (CVE-2026-76265, EPSS 0.00234, 13.2th percentile)

No CISA KEV listing, no public proof-of-concept, no Nuclei template, and no exploit code were identified for CVE-2026-76265 at the time of writing. No threat actor campaigns or exploit-in-the-wild evidence were available.