Splunk Enterprise CVE-2026-76280

Requires an authenticated Splunk account that does NOT hold the 'admin' or 'sc_admin' role, plus a deployment running Splunk Secure Gateway (the app backing the Splunk mobile experience) on an affected Splunk Enterprise version. The specific precondition is that the Secure Gateway alert and mobile-device recipient KV Store collections are configured with unrestricted write access rather than restricting writes to authorized Secure Gateway workflows - the default/affected state. Limiting factors: exploitation is impossible without valid credentials (PR:L), is scoped only to Secure Gateway alert/subscription data (not arbitrary Splunk data or OS-level access), and environments that do not deploy Splunk Secure Gateway are not exposed.

This is a moderate-severity broken-access-control flaw (CVSS 6.3, CWE-732) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L shows network reach and low attack complexity, but it explicitly requires low-level authentication (PR:L) - any valid non-admin Splunk user, not an anonymous attacker. Impact is capped at Low across confidentiality, integrity, and availability with an unchanged scope, reflecting that the attacker can only tamper with Splunk Secure Gateway alert and mobile-device recipient data in specific KV Store collections, not seize full control. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. The realistic risk is an insider or a compromised low-privilege account abusing trust in the alerting/subscription pipeline (e.g., redirecting or poisoning mobile alerts), which is meaningful in high-trust SOC environments but far from the drive-by RCE that the AV:N label alone might suggest. NOTE: the input Tag 'Information Disclosure' conflicts with the actual defect, which is unauthorized WRITE/modification (integrity), per CWE-732 and the description - treat the tag as suspect.

A legitimate but low-privileged Splunk user (lacking the admin or sc_admin role) authenticates and issues KV Store REST API writes to the Splunk Secure Gateway collections that store alert and mobile-device recipient data. Because those collections grant unrestricted write access instead of limiting writes to authorized Secure Gateway workflows, the user tampers with recipient entries so that later alert and subscription workflows deliver, suppress, or misroute mobile notifications. No public exploit code is identified at time of analysis, and exploitation requires a valid account on the Splunk instance.