Splunk Splunk Secure Gateway
20 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-76295 | 3.10 – < 3.10.12 ; 3.9 – < 3.9.26 ; 3.8 – < 3.8.73 | SPL Injection through the REST API in Splunk Secure Gateway | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-76292 | 3.10 – < 3.10.12 ; 3.9 – < 3.9.26 ; 3.8 – < 3.8.73 | Missing Authorization through REST API Endpoints in Splunk Secure Gateway | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-76280 | 3.10 – < 3.10.11 ; 3.9 – < 3.9.25 ; 3.8 – < 3.8.72 | Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-76272 | 3.10 – < 3.10.11 ; 3.9 – < 3.9.25 ; 3.8 – < 3.8.72 | Missing Access Control through the REST API in Splunk Secure Gateway | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-76265 | 3.10 – < 3.10.11 ; 3.9 – < 3.9.25 ; 3.8 – < 3.8.72 | Improper Access Control through REST API Endpoints in Splunk Secure Gateway | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-76351 | 3.10 – < 3.10.9 ; 3.9 – < 3.9.23 ; 3.8 – < 3.8.70 | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway | HIGH 8.8 | 0.4 % | ||
| CVE-2026-76347 | 3.10 – < 3.10.9 ; 3.9 – < 3.9.23 ; 3.8 – < 3.8.70 | Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-76327 | 3.10 – < 3.10.9 ; 3.9 – < 3.9.23 ; 3.8 – < 3.8.70 | SPL Injection through Splunk Web in Splunk Secure Gateway | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-76261 | 3.10 – < 3.10.9 ; 3.9 – < 3.9.23 ; 3.8 – < 3.8.70 | Insecure Default Access Control List through the REST API in Splunk Secure Gateway | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-76258 | 3.10 – < 3.10.10 ; 3.9 – < 3.9.24 ; 3.8 – < 3.8.71 | Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-76257 | 3.10 – < 3.10.10 ; 3.9 – < 3.9.24 ; 3.8 – < 3.8.71 | Missing Authorization through REST API Endpoints in Splunk Secure Gateway | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-76256 | 3.10 – < 3.10.9 ; 3.9 – < 3.9.23 ; 3.8 – < 3.8.70 | Information Exposure through REST API Endpoints in Splunk Secure Gateway | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-20251 | 3.10 – < 3.10.6 ; 3.9 – < 3.9.20 ; 3.8 – < 3.8.67 | Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway | HIGH 8.8 | 32 % | ||
| CVE-2025-20389 | 3.9 – < 3.9.10 ; 3.8 – < 3.8.58 ; 3.7 – < 3.7.28 | Improper Input Validation in "label" column field in Splunk Secure Gateway App | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-20383 | 3.9 – < 3.9.10 ; 3.8 – < 3.8.58 ; 3.7 – < 3.7.28 | Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-20230 | 3.8 – < 3.8.38 ; 3.7 – < 3.7.23 | Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-20231 | 3.8 – < 3.8.38 ; 3.7 – < 3.7.23 | Sensitive Information Disclosure in Splunk Secure Gateway App | HIGH 7.1 | 0.5 % | ||
| CVE-2024-53243 | 3.8 – < 3.8.5 ; 3.7 – < 3.7.18 ; 3.4 – < 3.4.262 | Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-53247 | 3.7 – < 3.7.13 ; 3.4 – < 3.4.261 | Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app | HIGH 8.8 | 1.1 % | ||
| CVE-2024-45735 | 3.6 – < 3.6.17 ; 3.4 – < 3.4.259 | Improper Access Control for low-privileged user in Splunk Secure Gateway App | MEDIUM 4.3 | 0.3 % |