Description
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.
The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.
For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.
For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.
Published: 2026-10-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized privileged execution of SPL commands
Action: Immediate Patch
AI Analysis

Impact

A user with the schedule_search role capability can bypass the usual safeguards applied to scheduled searches in Splunk Enterprise. This allows the user to run risky Search Processing Language commands that can expose or modify data or cause availability disruptions. The flaw originates from the search scheduler failing to enforce SPL safeguards for scheduled searches, leading to an improper access control vulnerability (CWE‑284).

Affected Systems

Splunk Enterprise versions older than 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are affected. Users with roles that grant the schedule_search capability within these installations are at risk.

Risk and Exploitability

The CVSS score of 8.8 classifies this as high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector likely relies on an authenticated user; therefore, internal threat actors or compromised accounts with the schedule_search role could exploit this issue. The potential impact spans confidentiality, integrity, and availability for the affected Splunk data environment.

Generated by OpenCVE AI on October 22, 2026 at 04:06 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or later.
  • Audit all roles that include the schedule_search capability and restrict that capability to only trusted administrators.
  • Enable and enforce the Splunk SPL safeguards for risky commands as documented in the Splunk help resources.

Generated by OpenCVE AI on October 22, 2026 at 04:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 21 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation. For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.
Title Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-23T10:57:45.799Z

Reserved: 2026-08-19T12:02:03.622Z

Link: CVE-2026-76291

cve-icon Vulnrichment

Updated: 2026-10-23T10:57:40.675Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-21T23:17:26.943

Modified: 2026-10-30T16:01:26.113

Link: CVE-2026-76291

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T05:00:11Z

Weaknesses