CVE-2026-76350: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. in Splunk Splunk Enterprise

CVE-2026-76350 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user holding a role with the schedule_search capability can configure PDF attachments in email alert actions. When these alerts run, arbitrary Search Processing Language (SPL) commands may be executed with system-level privileges due to the search scheduler passing a system-level authentication context rather than the action owner context during PDF rendering. This vulnerability can lead to unauthorized data exposure and compromise system integrity and availability on the search head.

An attacker with schedule_search capability can execute arbitrary SPL commands with system-level privileges, leading to full data exposure relevant to the search and potential compromise of system integrity and availability on the Splunk search head. This elevates privileges beyond intended role restrictions and can severely impact confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles with the schedule_search capability to trusted users only and monitor configurations of email alert actions involving PDF attachments. Review Splunk documentation on alert_actions.conf for configuration best practices.