Loading vulnerability…
Multiple Splunk Secure Gateway REST API endpoints fail to enforce authorization before processing requests, allowing a Splunk user without the admin or power roles to access privileged functionality and cause the gateway to sign attacker-controlled payloads. The stated affected versions are Splunk Enterprise releases before 10.4.3, 10.2.7, 10.0.10, and 9.4.15 within their respective branches, and Splunk Secure Gateway releases before 3.10.11, 3.9.25, and 3.8.72. The vulnerability identity is inconsistent: CVE-2026-76265 is also described as resource exhaustion against the Splunk daemon, while the payload-signing authorization bypass is separately attributed to CVE-2026-76272.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.