CVE-2026-76347

🗓️ 19 Aug 2026 21:34:43Reported by ciscoType

SSRF in Splunk Secure Gateway report notifications lets non-admin users send authenticated requests to internal services causing DoS and cluster state changes.

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-76347	20 Aug 202604:47	–	circl
Cvelist	CVE-2026-76347 Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway	19 Aug 202621:34	–	cvelist
EUVD	EUVD-2026-62912	20 Aug 202600:35	–	euvd
NCSC	Splunk Enterprise’s vulnerabilities are exploited through Splunk	21 Aug 202608:16	–	ncsc
NVD	CVE-2026-76347	19 Aug 202622:17	–	nvd
Positive Technologies	PT-2026-78774	19 Aug 202600:00	–	ptsecurity

NVD

Node

splunk splunkRange9.4.0–9.4.14enterprise

splunk splunkRange10.0.0–10.0.9enterprise

splunk splunkRange10.2.0–10.2.6enterprise

splunk splunkRange10.4.0–10.4.2enterprise

splunk splunk_secure_gatewayRange3.8.0–3.8.70

splunk splunk_secure_gatewayRange3.9.0–3.9.23

splunk splunk_secure_gatewayRange3.10.0–3.10.9

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.4.2"
      },
      {
        "version": "10.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.2.6"
      },
      {
        "version": "10.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.9"
      },
      {
        "version": "9.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.4.14"
      }
    ],
    "modules": [
      "Splunk Secure Gateway"
    ]
  },
  {
    "product": "Splunk Secure Gateway",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "3.10",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "3.10.9"
      },
      {
        "version": "3.9",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "3.9.23"
      },
      {
        "version": "3.8",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "3.8.70"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2026-0801

21 Aug 2026 19:17Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.4

EPSS0.00209

CWE-918