CVE-2026-76280: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user lacking the "admin" or "sc_admin" roles can modify alert and mobile-device recipient data stored in App Key Value Store collections. These collections are used by alert and subscription workflows. The vulnerability arises because the affected collections allow unrestricted write access, failing to limit writes to authorized Splunk Secure Gateway workflows. This improper permission specification for a security-critical resource can lead to unauthorized data modification.

An authenticated user without elevated admin roles can modify critical alert and subscription data in Splunk Secure Gateway's key-value store collections. This could lead to unauthorized changes in alerting behavior and mobile-device recipient information, potentially disrupting monitoring and notification workflows. The CVSS score of 6.3 indicates a medium severity impact with confidentiality, integrity, and availability impacts rated low to medium.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions 3.10.11, 3.9.25, and 3.8.72. Users should upgrade to these or later versions to remediate the vulnerability. The vendor documentation provides guidance on managing role-based access and securing the app key value store. No additional mitigation steps are indicated beyond applying the official fixes.