CVE-2026-76350: Splunk Enterprise Privilege Escalation Flaw

CVE-2026-76350 Overview

CVE-2026-76350 is a privilege escalation vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A low-privileged user holding a role with the schedule_search capability can configure Portable Document Format (PDF) attachments in the email alert action workflow. When the scheduled alert runs, the search scheduler passes a system-level authentication context to the email alert action rather than the action owner context. This allows arbitrary Search Processing Language (SPL) commands to execute with system-level privileges on the search head, exposing all indexed data and impacting integrity and availability.

Critical Impact
Authenticated users with the schedule_search capability can execute SPL commands as the system user, exposing all data on the search head and compromising integrity and availability.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6
Splunk Enterprise versions below 10.0.9 and 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76350 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-76350

Vulnerability Analysis

The vulnerability resides in the Splunk Enterprise email alert action workflow. When a scheduled search triggers an email alert with a PDF attachment, the search scheduler renders the PDF by executing the associated SPL. The rendering step runs under a system-level authentication context instead of inheriting the alert owner's permissions.

An attacker who holds any role granting the schedule_search capability can craft a scheduled search and configure a PDF email alert action. The SPL embedded in that alert then executes with elevated privileges when the schedule fires. This bypasses role-based access controls and grants access to indexes, lookups, and knowledge objects the attacker could not otherwise reach.

The issue is classified under CWE-269: Improper Privilege Management. Because the attack originates over the network from an authenticated but low-privileged account, exploitation does not require user interaction on the search head itself.

Root Cause

The search scheduler substitutes a system-level authentication context in place of the alert owner context when generating PDF attachments. This design choice conflates the identity used for rendering with the identity used for authorization, breaking the principle of least privilege.

Attack Vector

Exploitation requires an authenticated Splunk account with a role that includes the schedule_search capability. The attacker creates or edits a scheduled search, enables the email alert action, and selects PDF attachment output. When the schedule triggers, the SPL payload executes with system-level privileges. Additional technical detail is available in the Splunk Security Advisory SVD-2026-0801 and the alert_actions.conf reference.

Detection Methods for CVE-2026-76350

Indicators of Compromise

Scheduled searches created by non-administrative users that enable the sendpdf or PDF attachment option in the email alert action.
Unexpected entries in scheduler.log showing alert executions running under the system context for user-owned searches.
SPL commands in saved searches that reference indexes or knowledge objects outside the owner's normal role permissions.

Detection Strategies

Audit savedsearches.conf and the REST endpoint /services/saved/searches for entries where action.email.sendpdf = 1 and the owner is not an administrator.
Correlate scheduled search execution events with the results returned to identify SPL that accesses data beyond the owner's role.
Alert on newly created or modified saved searches that add PDF email actions immediately after role or capability changes.

Monitoring Recommendations

Review internal Splunk logs (index=_internal sourcetype=scheduler) for anomalous alert action executions.
Track role assignments that include the schedule_search capability and enforce periodic recertification.
Ingest search head audit logs into a centralized data lake to correlate scheduled search activity with data access anomalies.

How to Mitigate CVE-2026-76350

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later.
Inventory all user roles that grant the schedule_search capability and revoke it where not required.
Review existing scheduled searches with PDF email actions and disable any that were created by non-administrative users pending investigation.

Patch Information

Splunk has released fixed builds addressing CVE-2026-76350. Administrators should apply the patched versions referenced in the Splunk Security Advisory SVD-2026-0801. Restart the search head after the upgrade completes and validate that scheduled PDF alerts execute under the correct owner context.

Workarounds

Disable the PDF attachment feature in alert_actions.conf by setting the email PDF options to off until patches are applied.
Restrict the schedule_search capability to trusted administrators only through role management.
Remove or restrict access to the email alert action for roles that do not require it.

bash

# Configuration example: disable PDF email attachments in alert_actions.conf
[email]
sendpdf = 0
reportServerEnabled = 0