Splunk Enterprise CVE-2026-76253

Exploitation requires an authenticated Splunk Enterprise user holding a role with the schedule_search capability explicitly assigned - this capability is NOT granted by default to standard or viewer roles and must be deliberately included in a role definition by an administrator. The attacker must also have the ability to create or modify scheduled searches and configure their associated alert actions within the Splunk UI or via the REST API. Exploitation is constrained by: (1) mandatory authentication - unauthenticated or anonymous access cannot trigger this flaw; (2) explicit schedule_search capability assignment - accounts without this capability are not exploitable regardless of other permissions; (3) the ability to reach the Splunk web interface or API over the network. There is no requirement for a non-default deployment configuration beyond at least one non-administrator user holding the schedule_search capability. The limiting factor for most enterprises is identifying whether schedule_search has been delegated outside the admin tier.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible, low-complexity flaw requiring only low-privilege authentication - a meaningful but not insurmountable bar. The PR:L designation is the critical risk-limiting factor: exploitation is gated on possessing an account with the schedule_search capability, which is not a default assignment for standard or viewer roles in Splunk. Organizations that tightly control capability delegation face significantly reduced exposure. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. However, the impact chain is severe: arbitrary SPL execution at maximum privilege combined with full credential store read access creates conditions for complete environment compromise and lateral movement to all data sources integrated with Splunk. The CVSS scope metric (S:U) reflects containment within Splunk's authority boundary, but the credential exfiltration risk effectively extends the blast radius to every connected system. This is a genuine priority patch - not a high-CVSS-but-low-real-risk finding - for any deployment where schedule_search has been delegated beyond the administrator tier.

An attacker with a Splunk account assigned a role that includes the schedule_search capability navigates to the scheduled search interface, creates a scheduled search, and crafts a manipulated alert action configuration that exploits the scheduler's failure to restrict user-specific settings, causing the search scheduler to execute arbitrary SPL commands at the highest system privilege level. Using that elevated SPL execution context, the attacker issues commands to read the Splunk credential store, extracting stored usernames and passwords for integrated data sources, forwarder tokens, and third-party service credentials. No public proof-of-concept has been identified at time of analysis, but the attack path requires only authenticated network access and knowledge of SPL - both widely available to Splunk power users.