CVE-2026-76351: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2026-76351 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Enterprise and Splunk Secure Gateway that allows low-privileged authenticated users to escalate privileges and obtain system-level session tokens without a password. It affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The vulnerability was published on August 19, 2026, and assigned by Cisco Systems, Inc. as the CNA. It carries a CVSS v3.1 base score of 8.8 (High) (Splunk Advisory, Github Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), specifically because Splunk Secure Gateway fails to validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API. An authenticated attacker with any low-privileged Splunk account (not requiring "admin" or "power" roles) can craft malicious report notification data that causes Splunk Secure Gateway to issue REST API calls using a system-level session token. This allows the attacker to manipulate the token-generation flow and obtain a valid session token without supplying a password, effectively bypassing authentication controls. No public proof-of-concept exploit code has been identified at this time (Splunk Advisory, Github Advisory).

Successful exploitation allows any authenticated low-privileged user to modify Splunk platform configuration, forge system-level session tokens without credentials, and gain full access to all data indexed and managed by the Splunk platform. The combined high confidentiality, integrity, and availability impact means an attacker could exfiltrate sensitive log and security data, alter platform configurations to cover tracks or persist access, and potentially disrupt Splunk's availability. Given Splunk's common role as a SIEM and central log aggregator, compromise could expose an organization's entire security monitoring infrastructure and facilitate lateral movement (Splunk Advisory, Github Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Splunk Advisory).

1. Reconnaissance: Identify Splunk Enterprise deployments running affected versions (below 10.4.2, 10.2.6, 10.0.9, or 9.4.14) with Splunk Secure Gateway enabled, using network scanning or Splunk's web interface version disclosure.
2. Obtain low-privileged credentials: Authenticate to the Splunk platform with any valid account that does not hold the "admin" or "power" role — this could be a standard user account.
3. Craft malicious report notification data: Construct report notification identifiers that, when decoded by Splunk Secure Gateway, cause it to issue unintended requests to the Splunk Enterprise REST API. The identifiers are not validated before being used to build API request paths or parameters.
4. Trigger SSRF via Secure Gateway: Submit the crafted notification data to Splunk Secure Gateway, causing it to make REST API calls to Splunk Enterprise using a system-level session token on behalf of the attacker.
5. Modify platform configuration: Use the system-level token access to alter Splunk configuration (e.g., create new admin accounts, modify data inputs, or change access controls).
6. Obtain persistent session token: Extract or generate a session token through the manipulated API interaction, enabling ongoing authenticated access to all Splunk data and administrative functions without requiring a password (Splunk Advisory, Github Advisory).

• Logs: Splunk Secure Gateway logs showing unexpected or malformed report notification identifiers being processed; REST API calls to Splunk Enterprise originating from the Secure Gateway service using system-level tokens at unusual times or frequencies.
• Logs: Splunk audit logs (_audit index) showing configuration changes (e.g., new user creation, role modifications, input changes) made by system-level tokens not associated with admin activity.
• Logs: Authentication logs showing session token usage without a corresponding password-based login event, particularly for non-admin accounts.
• Network: Unusual internal REST API traffic from the Splunk Secure Gateway host to Splunk Enterprise REST endpoints (default port 8089) with unexpected request patterns or payloads.
• Behavioral: Low-privileged user accounts accessing data or performing actions inconsistent with their assigned roles, or new admin-level accounts appearing without documented provisioning.

Splunk has released patched versions addressing this vulnerability: update Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 (or later), and update Splunk Secure Gateway to version 3.10.9, 3.9.23, or 3.8.70 (or later). As an interim workaround prior to patching, restrict access to report notification features to trusted users only, and audit existing user roles to ensure the principle of least privilege is enforced. Organizations should also review Splunk audit logs for any anomalous configuration changes or unexpected session token usage that may indicate prior exploitation (Splunk Advisory).