Splunk Enterprise CVE-2026-76291

Exploitation requires an authenticated Splunk Enterprise account assigned a role that holds the schedule_search capability (per authorize.conf); without this capability the attacker cannot create the scheduled search that triggers the flaw. The specific defect is that the search scheduler does not apply the SPL safeguards for risky commands that would otherwise block such commands in interactive searches, so the condition is simply having schedule_search and the ability to define a scheduled search containing risky SPL. Limiting factors: the attacker must already be authenticated and privileged enough to schedule searches (not an anonymous attacker), and affected deployments must be running a version below 10.4.4, 10.2.8, 10.0.11, or 9.4.16; environments that strictly restrict the schedule_search capability materially reduce the attack surface.

This is a legitimately elevated-risk flaw but not an unauthenticated internet-facing emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity exploitation with no user interaction, and full compromise of confidentiality, integrity, and availability - consistent with the description that risky SPL commands can disclose, alter, or disrupt Splunk Enterprise data. The key tempering signal is PR:L: exploitation requires an authenticated account already holding a role with the schedule_search capability, so this is a privilege/safeguard-boundary bypass by an existing low-privileged insider rather than an anonymous external attacker. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automated weaponization - the risk is currently driven by severity and the breadth of Splunk's deployment, not by observed in-the-wild activity. Note a terminology conflict: the input Tags label this an 'Authentication Bypass,' but the description and CWE-284 (Improper Access Control) describe bypassing SPL safeguards for risky commands via the scheduler - an authorization/safeguard bypass by an already-authenticated user, not an authentication bypass; treat the tag with caution.

An authenticated Splunk user who has been granted the schedule_search capability creates a scheduled search containing SPL commands that would normally be blocked by the risky-command safeguards in an ad-hoc search. Because the scheduler does not apply those safeguards, the search runs on schedule and executes the risky commands, letting the user exfiltrate or modify indexed data or degrade Splunk availability. No public exploit code was identified at time of analysis, and the attack requires no victim interaction.