Splunk Secure Gateway EUVD-2026-63108

Exploitation requires a valid Splunk user account that does NOT hold the 'admin' or 'power' role - the 'user' role or any equivalent low-privilege Splunk role is sufficient. Splunk Secure Gateway must be installed and running in the target environment. The affected REST API endpoints are network-accessible (AV:N), so no special network positioning is needed beyond reaching the Splunk API interface (typically TCP 8089 or 8000). Exploitation is limited by: (1) requirement for at least a low-privilege authenticated Splunk session - unauthenticated external attackers cannot exploit this without first obtaining credentials; (2) meaningful exposure only occurs when the organization has configured SAML authentication in Splunk - environments without any SAML setup will have no sensitive configuration data returned even if the endpoint responds. The non-default nature of SAML configuration in smaller Splunk deployments reduces the exploitable population below the full installed base.

The CVSS base score of 4.3 accurately reflects limited real-world impact: attack complexity is low, but exploitation requires a valid Splunk account (PR:L), which meaningfully constrains the attacker pool to insiders or compromised credentials. No CISA KEV listing and no public POC code have been identified, placing exploitation probability in the lower range; EPSS data was not provided in source intelligence so a numeric probability cannot be stated. The practical risk is elevated by the sensitivity of what is exposed: SAML configuration details can reveal the IdP in use, certificate material, and SSO topology, enabling a knowledgeable attacker to plan credential-bypass or IdP-targeting attacks. Organizations relying heavily on SAML SSO for Splunk access should treat this as a higher-priority patch despite the moderate score. Conversely, Splunk deployments not using SAML authentication are unaffected by the substantive exposure even if the endpoint exists, reducing urgency in those environments. The vulnerability was reported by Cisco, adding credibility to the finding, though no active exploitation claims accompany that report.

An attacker with a low-privilege Splunk account - such as a read-only analyst or an account obtained through credential stuffing against the Splunk login - sends an HTTP GET request directly to an affected Splunk Secure Gateway REST API endpoint that returns SAML configuration data. Because no authorization check is performed, the endpoint returns SAML IdP metadata, entity identifiers, and certificate information in the response. The attacker uses this information to map the SSO infrastructure and potentially craft targeted attacks against the identity provider or intercept SAML assertions.