CVE-2026-76253

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with a role possessing the schedule search capability can execute arbitrary Search Processing Language (SPL) commands with maximum system privileges. This allows the user to access all credentials in the credential store, potentially leading to the disclosure or modification of sensitive data and impacting system integrity and availability. The issue occurs because the scheduled search alert action configuration fails to properly restrict user-specific alert action settings before the search scheduler executes those actions.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.