In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user… (CVE-2026-76347)

CVE-2026-76347 is a Server-Side Request Forgery (SSRF) vulnerability affecting multiple versions of Splunk Enterprise and Splunk Secure Gateway. Users lacking elevated privileges (admin or power roles) can exploit this flaw by manipulating report notification paths to send authenticated requests internally. This can result in unauthorized modifications to the Search Head Cluster state and cause denial of service conditions. The root cause is insufficient validation of notification path values in Splunk Secure Gateway before dispatching internal requests.

The vulnerability allows low-privileged users to perform SSRF attacks that can alter the Search Head Cluster state and cause denial of service. There is no confidentiality impact reported. The integrity and availability of the affected Splunk services can be compromised. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to prevent unauthorized users from sending report notifications or accessing vulnerable versions. Monitor vendor communications for updates on patches or official mitigations.