CVE-2026-76280

Executive Summary

CVE-2026-76280 is an improper access control vulnerability (CWE-732) in Splunk Secure Gateway, a component of Splunk Enterprise. An authenticated user holding neither the admin nor sc_admin role can directly modify alert and mobile-device recipient data stored in App Key Value Store (KV Store) collections, because those collections permit unrestricted writes rather than restricting them to authorized Secure Gateway workflows. Although the CVSS base score is moderate (6.3), the flaw undermines the integrity of alerting and mobile push subscription pipelines, allowing a low-privileged insider to redirect or suppress security notifications.

Technical Analysis

The vulnerability resides at the intersection of Splunk's role-based access control (RBAC) model and the App Key Value Store (KV Store), the MongoDB-backed storage layer used by the platform for structured application data. Splunk Secure Gateway maintains alert definitions and mobile-device recipient records in KV Store collections so that alert and subscription workflows can fan out notifications to registered devices.

CWE-732 ("Incorrect Permission Assignment for Critical Resource") applies because the affected KV Store collections are not scoped with collection-level write permissions that restrict modification to authorized Secure Gateway workflows. Instead, the collections "allow unrestricted write access." In practice this means that a user who is authenticated and holds no administrative role can still issue write operations against those collections.

The relevant trust boundary is the KV Store REST endpoint surface. Splunk exposes KV Store collections through its REST API, and authorization for those collections is governed by role-based user access configuration. Where a collection lacks properly assigned write permissions, any authenticated principal that can reach the endpoint can perform writes. The NVD description does not disclose the specific endpoint path, collection name, or required payload schema, so those details are not asserted here.

Key characteristics of the flaw:

• Attack vector: Network (AV:N) — the KV Store is reachable over Splunk's REST interface.
• Privileges required: Low (PR:L) — any valid authenticated account lacking admin/sc_admin suffices.
• User interaction: None (UI:N) — no victim action is needed; the attacker writes directly.
• Scope: Unchanged (S:U) — impact remains within the Secure Gateway/alerting component.
• Confidentiality/Integrity/Availability: All Low (C:L/I:L/A:L) — reflecting limited but real effects on recipient data, notification integrity, and potential disruption of delivery workflows.

Because the write is performed using a legitimate authenticated session against a platform API, the activity may appear as ordinary API traffic rather than an obvious intrusion, complicating detection.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE, and EPSS is negligible (0.00170, 5.8th percentile). The following chain is inferred at the vulnerability-class level from the NVD description; it does not rely on undocumented endpoints, collection names, or parameters.

1. Reconnaissance / target identification. The adversary obtains or is granted a low-privileged authenticated account on a Splunk Enterprise deployment that hosts Splunk Secure Gateway, and that is running an affected version (Enterprise below 10.4.3 / 10.2.7 / 10.0.10 / 9.4.15, or Secure Gateway below 3.10.11 / 3.9.25 / 3.8.72). The attacker enumerates reachable KV Store collections through the standard KV Store REST interface described in Splunk's KV store endpoint documentation, identifying the Secure Gateway collections holding alert and mobile-device recipient data.

2. Triggering the flaw. Because the affected collections permit unrestricted writes, the low-privileged user submits write operations to those collections using their own authenticated session — without holding admin or sc_admin. The absence of a role enforced at the collection boundary, rather than any malformed input, is what permits the write. No exploitation primitive such as injection or memory corruption is required; the flaw is purely an authorization/permission-assignment defect (CWE-732).

3. Execution method (vulnerability-class level). The attacker alters stored alert and mobile-device recipient records. At the class level this consists of unauthorized record modification (data manipulation) against KV Store documents that downstream alert and subscription workflows later consume. The specific document fields, payload structure, and HTTP verb are not disclosed in the available data and are therefore not specified here.

4. Post-exploitation impact. Modified recipient data is subsequently read by alert and subscription workflows, causing notifications to be misdirected, suppressed, or generated against attacker-influenced targets. Failure to modify a collection optimally could also disrupt delivery, degrading availability of the notification channel. The integrity of the alerting pipeline — a security-relevant function — is the primary casualty.

Impact Assessment

Business impact centers on the reliability of the alerting and mobile-notification pipeline. Splunk Secure Gateway is used to push alerts and subscription content to mobile devices and integrated endpoints; tampering with recipient records can redirect sensitive security alerts to unintended recipients or silently remove legitimate recipients, degrading an organization's ability to detect and respond to incidents in a timely manner.

Referencing the CVSS v3.1 subscores: Attack Vector Network and Attack Complexity Low mean the flaw is straightforward to reach and leverage once authenticated; Privileges Required Low and User Interaction None mean only a valid non-admin account is needed and no target victim action is required; Scope Unchanged and Low Confidentiality/Integrity/Availability impacts place the base score at 6.3 (Moderate). The blast radius is bounded by the number of Secure Gateway deployments and the population of low-privileged accounts with KV Store access, but the security consequence is disproportionate to the score because the affected data governs how and to whom security alerts are delivered.

Affected systems: Splunk Enterprise 9.4.x (< 9.4.15), 10.0.x (< 10.0.10), 10.2.x (< 10.2.7), 10.4.x (< 10.4.3), and Splunk Secure Gateway 3.8.x (< 3.8.72), 3.9.x (< 3.9.25), 3.10.x (< 3.10.11). Any deployment where non-administrative users can authenticate and reach the KV Store REST surface is potentially exposed. There is no evidence of in-the-wild exploitation, CISA KEV listing, or public exploit code at the time of writing.

Detection Guidance

Sigma Rule

title: Splunk Secure Gateway KV Store Unauthorized Write Activity
id: 7a1c9e42-0f3b-4d18-9a2c-5b6e76280a01
status: experimental
description: Detects authenticated non-admin writes to Splunk Secure Gateway alert and mobile-device recipient KV Store collections (CVE-2026-76280)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76280
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  product: splunk
  service: audit
detection:
  selection_endpoint:
    action|contains:
      - 'kvstore'
  selection_method:
    http_method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  selection_role:
    user_roles|contains:
      - 'user'
      - 'power'
  filter_admin:
    user_roles|contains:
      - 'admin'
      - 'sc_admin'
  condition: selection_endpoint and selection_method and selection_role and not filter_admin
fields:
  - user
  - user_roles
  - http_method
  - uri_path
  - src_ip
falsepositives:
  - Legitimate Secure Gateway workflows executed by service accounts
  - Administrative maintenance by authorized admins (excluded)
level: medium
tags:
  - attack.t1565
  - cve.2026.76280

YARA Rule

rule CVE_2026_76280_Splunk_Secure_Gateway_KVStore_Write
{
    meta:
        description = "Detects KV Store write payloads targeting Splunk Secure Gateway alert/recipient collections"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76280"
        cve = "CVE-2026-76280"
        date = "2026-01-01"

    strings:
        $kv1 = "kvstore" nocase
        $kv2 = "storage/collections" nocase
        $sg1 = "secure_gateway" nocase
        $sg2 = "securegateway" nocase
        $recip = "recipient" nocase
        $alert = "alert" nocase
        $dev = "device" nocase
        $m1 = "POST" ascii
        $m2 = "PUT" ascii
        $m3 = "PATCH" ascii

    condition:
        ($kv1 or $kv2) and
        ($sg1 or $sg2 or $recip or $dev) and
        ($alert or $recip) and
        ($m1 or $m2 or $m3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76280 - Splunk Secure Gateway KV Store Unauthorized Write Attempt"; flow:established,to_server; content:"/servicesNS/"; http_uri; content:"/storage/collections/"; http_uri; nocase; http_method; content:"POST"; http_method; content:"secure_gateway"; http_uri; nocase; reference:cve,2026-76280; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-76280; classtype:attempted-user; sid:202676280; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [authentication where event.action == "user-authentication-success"]
  [http where http.request.method in ("POST", "PUT", "PATCH", "DELETE") and
   stringContains(http.request.body.text, "secure_gateway") and
   stringContains(url.path, "storage/collections")]

Splunk SPL Query

index=_audit action=*kvstore* OR uri_path="*storage/collections*"
| eval is_write=if(match(lower(http_method), "post|put|patch|delete"), 1, 0)
| where is_write=1
| eval is_secure_gateway=if(match(lower(coalesce(uri_path, uri, "")), "secure_gateway|recipient|device"), 1, 0)
| where is_secure_gateway=1
| search NOT user_roles IN ("admin", "sc_admin")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by user, src_ip, user_roles
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="splunk,web,access_control,">
  <rule id="20276280" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">kvstore</field>
    <field name="http_method">POST|PUT|PATCH|DELETE</field>
    <field name="uri_path">storage/collections</field>
    <description>CVE-2026-76280: Possible unauthorized Splunk Secure Gateway KV Store write by non-admin user</description>
    <mitre>
      <id>T1565</id>
    </mitre>
    <group>cve_2026_76280,kvstore_abuse,</group>
  </rule>

  <rule id="20276281" level="12">
    <if_sid>20276280</if_sid>
    <field name="uri_path">secure_gateway|recipient|device</field>
    <description>CVE-2026-76280: Confirmed unauthorized write to Splunk Secure Gateway alert/recipient collection</description>
    <group>cve_2026_76280,kvstore_abuse,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source. No vendor fix, workaround, or affected-version package data was provided in the available intelligence. The fixed versions named in the CVE description (Splunk Enterprise 10.4.3, 10.2.7, 10.0.10, 9.4.15 and Secure Gateway 3.10.11, 3.9.25, 3.8.72) were cited there but are not confirmed by any tracked patch source in this dataset; treat this as unverified until the vendor advisory is reviewed directly.

1. Immediate mitigations (defense-in-depth, unverified against vendor guidance):

   • Restrict and audit KV Store REST access by role where the platform permits collection-level permission tuning; ensure only authorized Secure Gateway workflows can write to alert/recipient collections.
   • Reduce the population of authenticated non-administrative accounts with network reachability to the KV Store REST surface; enforce network segmentation and least privilege.
   • Enable and forward Splunk audit logs (_audit index) to a monitored SIEM, and alert on non-admin KV Store write activity as specified in the Detection Guidance section.
   • Monitor Secure Gateway alert and subscription configurations for unexpected recipient changes.

2. Patch / upgrade steps:

   • Confirm the official advisory from Splunk (see References) before acting; this dataset does not confirm a released fix.
   • If the vendor advisory confirms fixed builds, upgrade Splunk Enterprise to at least 10.4.3, 10.2.7, 10.0.10, or 9.4.15, and Splunk Secure Gateway to at least 3.10.11, 3.9.25, or 3.8.72, as appropriate to the deployment's major version.
   • Validate post-upgrade that collection-level write permissions are enforced and that only authorized workflows can modify Secure Gateway collections.

3. Long-term hardening:

   • Apply least-privilege role design consistent with Splunk's role-based user access guidance; avoid granting broad KV Store write access to non-administrative roles.
   • Add collection-level authorization reviews to change management for any Splunk app that stores security-relevant data in the KV Store.
   • Continuously monitor for unauthenticated or unexpected KV Store writes and integrate those detections into SOC escalation playbooks.

References

• NVD — CVE-2026-76280: https://nvd.nist.gov/vuln/detail/CVE-2026-76280
• Splunk documentation — About the app key value store: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store
• Splunk documentation — KV store endpoint descriptions: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/kv-store-endpoints/kv-store-endpoint-descriptions
• Splunk documentation — About configuring role-based user access: https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access
• CWE-732 — Incorrect Permission Assignment for Critical Resource: https://cwe.mitre.org/data/definitions/732.html

Threat actor campaigns / exploit-in-the-wild evidence: none identified. The CVE is not listed in CISA KEV, EPSS is 0.00170 (5.8th percentile), and no public PoC, Nuclei template, or exploit code is known at this time.