Auditing Splunk Secure Gateway for CVE-2026-76272: version checks, roles and reachability
Auditing Splunk Secure Gateway for CVE-2026-76272: version checks, roles and reachability CVE-2026-76272 is a CWE-862 missing authorization bug in Splunk Secure Gateway with a CVSSv3.1 base score of 4.3. A modest score
Auditing Splunk Secure Gateway for CVE-2026-76272: version checks, roles and reachability
CVE-2026-76272 is a CWE-862 missing authorization bug in Splunk Secure Gateway with a CVSSv3.1 base score of 4.3. A modest score invites teams to triage on version number alone. The checks below are what make that triage hold up.
What the advisory establishes
Splunk published SVD-2026-1001 on 2026-10-07. An account that does not hold the admin or power roles can make Splunk Secure Gateway sign payloads the account controls, since the gateway never confirms that the requester is authorised to request a signature. Splunk tracks it as VULN-71728.
Verification steps
Begin with inventory. Record the Splunk Enterprise build on every search head, indexer and standalone instance, and track the Splunk Secure Gateway version as a separate line item, because the app follows its own release cadence. Compare those numbers against Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10 and 9.4.15, and against Splunk Secure Gateway versions below 3.10.11, 3.9.25 and 3.8.72.
Then look at reachability of the gateway endpoints. A deployment that pins management interfaces behind a jump host carries less risk than one that publishes them widely. Where the app is installed but Splunk Mobile, Spacebridge and Mission Control are not in use, removing the app is the lowest-cost fix.
Role review comes last. The flaw does not require admin or power, so a short list of privileged accounts does not shrink exposure by itself.
Exposure evidence
ZoomEye reports 47,639 instances for app="Splunk". Treat that as the size of the internet-facing population of the product, not as a count of vulnerable gateways.
Remediation and validation
Bring Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10 or 9.4.15 and Splunk Secure Gateway to 3.10.11, 3.9.25 or 3.8.72. Validate by reading the installed versions back from the running deployment instead of trusting a change ticket, and record the outcome.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.