{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/splunk-enterprise--10.4.4--10.2.8--10.0.11--9.4.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-76291"},{"id":"CVE-2026-76298"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Splunk Enterprise (\u003c 10.4.4, \u003c 10.2.8, \u003c 10.0.11, \u003c 9.4.16)","Splunk Enterprise (\u003c 10.4.4, \u003c 10.2.8)"],"_cs_severities":["high"],"_cs_tags":["splunk","vulnerability","privilege-escalation","server-side","command-execution","cve-2026-76298"],"_cs_type":"advisory","_cs_vendors":["Splunk"],"content_html":"\u003cp\u003eSplunk Enterprise contains a vulnerability where the search scheduler fails to apply Search Processing Language (SPL) safeguards to scheduled searches. An authenticated user possessing the 'schedule_search' capability can leverage this flaw to execute restricted or risky SPL commands that would otherwise be blocked. This vulnerability allows for unauthorized disclosure or modification of data stored within the Splunk platform, as well as potential service disruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with existing scheduled search permissions to execute restricted SPL commands, potentially leading to unauthorized data access, data alteration, or denial-of-service conditions within the Splunk environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, 9.4.16, or later to address the scheduler safeguard flaw.\u003c/li\u003e\n\u003cli\u003eReview and audit existing scheduled searches for users with the 'schedule_search' capability.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by restricting the 'schedule_search' capability to only those users and service accounts that strictly require it for operational duties.\u003c/li\u003e\n\u003cli\u003eRefer to the official Splunk 'SPL safeguards for risky commands' documentation to identify and restrict high-risk commands within your environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T23:49:16Z","date_published":"2026-10-21T23:49:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-splunk-enterprise-spl-bypass/","summary":"Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability where authenticated users with the schedule_search capability can bypass SPL command safeguards during scheduled searches, potentially leading to unauthorized data access, modification, or service disruption.","title":"Splunk Enterprise: Scheduled search SPL command safeguard bypass (CVE-2026-76291)","url":"https://feed.craftedsignal.io/briefs/2026-10-splunk-enterprise-spl-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Splunk Enterprise (\u003c 10.4.4, \u003c 10.2.8, \u003c 10.0.11, \u003c 9.4.16)","version":"https://jsonfeed.org/version/1.1"}