Splunk Secure Gateway EUVD-2026-107659

Exploitation requires an authenticated Splunk account that does NOT hold the 'admin' Splunk role or the 'sc_admin' Splunk Secure Gateway role, plus network access to the Splunk Secure Gateway App Key Value Store (KV Store) REST API endpoints. The Splunk Secure Gateway app must be present/enabled (it ships to support mobile alerting), and the deployment must run a version below the fixed releases (Splunk Enterprise below 10.4.4/10.2.8/10.0.11/9.4.16, or Splunk Secure Gateway below 3.10.12/3.9.26/3.8.73). Limiting factors: valid credentials are mandatory (no unauthenticated access), impact is read-only against mobile alert notification data specifically, and risk is greatest in multi-user/multi-tenant environments where user data separation matters; single-admin or isolated deployments have little exposed data.

This is a moderate-severity information-disclosure flaw (CWE-862, Missing Authorization) with a vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The vector signals favorable attacker conditions - network-reachable REST API, low attack complexity, no user interaction - but critically require PR:L, meaning the attacker must already be an authenticated low-privileged Splunk user (one lacking the 'admin' or 'sc_admin' role). Impact is confined to confidentiality (C:H) of mobile alert notification data belonging to other users; there is no integrity or availability impact (I:N/A:N) and no scope change (S:U). No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation-probability and active-exploitation signals cannot be weighed. On balance this reads as a genuine but bounded access-control/tenant-isolation issue rather than a top-tier emergency: it requires valid credentials and yields only read access to a specific data category. It warrants prompt patching in multi-tenant or least-privilege Splunk deployments where internal users should not see each other's data, but it is not a remote-unauthenticated RCE. No conflicting signals were found between the CVSS vector and the description - both consistently describe an authenticated, network-facing read-authorization gap.

A low-privileged but authenticated Splunk user (without admin/sc_admin roles), such as an insider or an attacker who has phished a standard account, issues crafted read requests to the Splunk Secure Gateway App Key Value Store REST API endpoints. Because the affected KV Store collections fail to enforce user-level authorization on reads, the attacker retrieves other users' mobile alert notification data. No public exploit code was identified in the provided data.