CVE-2026-76350 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with the schedule_search capability should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators should review system configurations, and security teams should monitor for suspicious activity. Vulnerability management teams should prioritize patching vulnerable versions, and platform administrators should restrict the schedule_search capability to trusted roles.

Technical summary

The vulnerability is due to the search scheduler passing a system-level authentication context instead of the action owner context when rendering PDF attachments in email alert actions. This allows users with the schedule_search capability to execute arbitrary SPL commands with system-level privileges, potentially exposing all relevant data and affecting system integrity and availability on the search head. The issue is specific to Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

Defensive priority

Splunk Enterprise users should prioritize patching vulnerable versions to prevent potential system compromise.

Recommended defensive actions

• Patch Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14
• Restrict schedule_search capability to trusted roles
• Monitor email alert actions for suspicious activity
• Review and update alert_actions.conf configurations
• Verify system configurations and user roles
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability allows users with the schedule_search capability to execute arbitrary SPL commands with system-level privileges when rendering PDF attachments in email alert actions. This issue affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Evidence is limited to public CVE and NVD information. Defenders should verify system configurations, user roles, and alert_actions.conf settings.

Official resources