CVE-2026-76350: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, a user role with schedule_search capability can exploit the email alert action workflow by configuring PDF attachments that execute arbitrary Search Processing Language (SPL) commands with system-level privileges. The root cause is that the search scheduler passes a system-level authentication context rather than the action owner context during PDF rendering in email alerts. This flaw leads to unauthorized privilege escalation, data exposure, and potential disruption of system integrity and availability on the search head.

The vulnerability allows privilege escalation to system-level rights for users with schedule_search capability, enabling execution of arbitrary SPL commands. This can result in unauthorized data exposure, compromise of system integrity, and denial of service on the Splunk search head.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.