Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation. For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.

Scores

EPSS (exploitation in 30 days)

0.39% · top 67% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-284: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. (opens in a new tab)All about CWE-284 and its CVEs

Affected products

• Splunk · Splunk Enterprise

  • affected 10.4 – < 10.4.4
  • affected 10.2 – < 10.2.8
  • affected 10.0 – < 10.0.11
  • affected 9.4 – < 9.4.16

What to do

Solution: Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.

References (1)

• https://advisory.splunk.com/advisories/SVD-2026-1007 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-76291](https://trackcve.app/badge/CVE-2026-76291.svg)](https://trackcve.app/cve/CVE-2026-76291)

Record last updated 23 Oct 2026, 10:57 UTC.