In Splunk Enterprise versions below the specified releases, a user with the schedule_search capability can configure PDF attachments for email alert actions. When these alerts execute, the system runs the contained SPL commands with a system‑level authentication context instead of the action owner’s context, allowing the attacker to run arbitrary queries. This can expose all indexed data, alter system integrity, and disrupt search head availability, effectively granting full control.

Splunk Enterprise, versions earlier than 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected. These releases are commonly used for log collection, monitoring, and compliance within large infrastructures.

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score is not available, and the vulnerability is not currently listed in the KEV catalog, but the lack of mitigation controls does not diminish the threat. An attacker who can obtain a schedule_search role can trigger the vulnerable alert and execute privileged SPL commands, leading to full data exposure and potential denial of service. The overall risk remains significant due to the high privilege scope and the ease with which the flaw can be exercised.