https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-76351.htmlhttps://patchthecve.com/cve/CVE-2026-76351.htmlFri, 21 Aug 2026 19:17:12 +0000HIGH 8.8: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to thehttps://patchthecve.com/cve/CVE-2026-76347.htmlhttps://patchthecve.com/cve/CVE-2026-76347.htmlFri, 21 Aug 2026 19:17:09 +0000MEDIUM 5.4: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated https://patchthecve.com/cve/CVE-2026-76327.htmlhttps://patchthecve.com/cve/CVE-2026-76327.htmlWed, 26 Aug 2026 16:16:39 +0000MEDIUM 6.4: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "sc_admin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator (URL). Thttps://patchthecve.com/cve/CVE-2026-76261.htmlhttps://patchthecve.com/cve/CVE-2026-76261.htmlMon, 26 Oct 2026 10:10:00 +0000MEDIUM 5.3: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebrhttps://patchthecve.com/cve/CVE-2026-76258.htmlhttps://patchthecve.com/cve/CVE-2026-76258.htmlMon, 26 Oct 2026 10:10:00 +0000MEDIUM 6.5: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user https://patchthecve.com/cve/CVE-2026-76257.htmlhttps://patchthecve.com/cve/CVE-2026-76257.htmlMon, 26 Oct 2026 10:10:00 +0000MEDIUM 6.5: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobilhttps://patchthecve.com/cve/CVE-2026-76256.htmlhttps://patchthecve.com/cve/CVE-2026-76256.htmlMon, 26 Oct 2026 10:10:00 +0000MEDIUM 4.3: In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information th