Improper access control in Splunk Enterprise - CVE-2026-76291
Published: October 22, 2026
Vulnerability identifier: #VU156975
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76291
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose or alter Splunk Enterprise data or disrupt service availability.
The vulnerability exists due to improper access control in the Splunk Enterprise search scheduler when executing scheduled searches without applying safeguards for risky SPL commands. A remote user can use the schedule_search capability to schedule searches containing risky commands and disclose or alter data or disrupt service availability.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76291
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4