CVE-2026-76253: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, a user role possessing the schedule_search capability can exploit improper privilege assignment and checks in scheduled search alert actions. This flaw enables execution of arbitrary Search Processing Language commands at the highest privilege level, granting access to all credentials in the credential store and the ability to modify critical data. The root cause is insufficient restriction on user-specific alert action settings prior to the search scheduler running alert actions.

An attacker with a role that includes schedule_search capability can gain unauthorized access to all stored credentials and execute commands with full system privileges. This can lead to disclosure and modification of sensitive data, compromising confidentiality, integrity, and availability of the Splunk Enterprise system.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official patches.