In affected versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user assigned a role with the schedule_search capability can exploit improper restrictions in scheduled search alert action configurations to run arbitrary Search Processing Language (SPL) commands with the highest system privileges. This vulnerability allows the attacker to read every credential stored in the credential store and potentially modify all relevant data, thereby compromising system integrity and availability. The root cause is the failure to properly restrict user-specific alert action settings prior to the execution of alert actions by the search scheduler.

Successful exploitation allows a user with schedule_search capability to execute arbitrary SPL commands with system-level privileges, leading to full disclosure and modification of credentials stored in the credential store. This compromises confidentiality, integrity, and availability of the system and its data.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Since this is an on-premises product, administrators must apply the update manually. Patch status is confirmed by the vendor advisory references in the description.