Splunk Enterprise EUVD-2026-62915

Exploitation requires an authenticated Splunk Enterprise session with a role that includes the schedule_search capability - this is a specific delegated capability that must be explicitly granted and is not present on all user accounts by default. The attacker must additionally have permission to configure email alert actions and specifically enable PDF attachment rendering within those actions. The vulnerability only activates at alert execution time, when the scheduler invokes the email action; simply configuring the alert is not sufficient without the alert condition being met. Limiting factors include: authentication is mandatory (PR:L per CVSS vector), the schedule_search capability must be present in the user's role (not a universal Splunk privilege), and impact is bounded to the search head tier. Non-default configurations that disable email alert actions or restrict PDF rendering would also prevent exploitation.

The CVSS 8.8 High score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability: the attack path is network-reachable, requires no complexity, demands no user interaction beyond alert configuration, and delivers full confidentiality, integrity, and availability impact on the search head once triggered. The PR:L designation is the sole mitigating CVSS factor, reflecting that the attacker must hold the schedule_search capability - a delegated Splunk role that may be broadly assigned across analyst and power-user populations in large SOC deployments. No EPSS data was included in the available intelligence, and the absence of a KEV listing or confirmed POC reduces near-term exploitation urgency, though the mechanism is clearly documented and the attack surface is well understood. The practical risk is highest in organizations with liberal schedule_search assignments; even a moderately sized enterprise security team should treat this as high-priority patching given the system-level impact on the search head, which in Splunk deployments typically indexes sensitive log and telemetry data from across the organization.

An authenticated Splunk analyst whose role includes schedule_search configures an email alert action with a PDF attachment containing a crafted SPL query targeting high-value indexes such as authentication logs or network telemetry. When the scheduled alert fires, the search scheduler invokes the PDF renderer under its system-level context, executing the SPL with full privileges - exposing all indexed data and enabling modification of search head configuration beyond the user's nominal role. No public POC has been confirmed, but the attack requires only standard Splunk web UI access and familiarity with alert action configuration.