Splunk Enterprise (< 10.4.4, < 10.2.8, < 10.0.11, < 9.4.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/splunk-enterprise--10.4.4--10.2.8--10.0.11--9.4.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 23:49:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSplunk Enterprise: Scheduled search SPL command safeguard bypass (CVE-2026-76291)https://feed.craftedsignal.io/briefs/2026-10-splunk-enterprise-spl-bypass/Wed, 21 Oct 2026 23:49:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-splunk-enterprise-spl-bypass/Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability where authenticated users with the schedule_search capability can bypass SPL command safeguards during scheduled searches, potentially leading to unauthorized data access, modification, or service disruption.Splunk Enterprise contains a vulnerability where the search scheduler fails to apply Search Processing Language (SPL) safeguards to scheduled searches. An authenticated user possessing the 'schedule_search' capability can leverage this flaw to execute restricted or risky SPL commands that would otherwise be blocked. This vulnerability allows for unauthorized disclosure or modification of data stored within the Splunk platform, as well as potential service disruption.

Impact

Successful exploitation allows an authenticated user with existing scheduled search permissions to execute restricted SPL commands, potentially leading to unauthorized data access, data alteration, or denial-of-service conditions within the Splunk environment.

Recommendation

  • Upgrade Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, 9.4.16, or later to address the scheduler safeguard flaw.
  • Review and audit existing scheduled searches for users with the 'schedule_search' capability.
  • Apply the principle of least privilege by restricting the 'schedule_search' capability to only those users and service accounts that strictly require it for operational duties.
  • Refer to the official Splunk 'SPL safeguards for risky commands' documentation to identify and restrict high-risk commands within your environment.
]]>highadvisorysplunkvulnerabilityprivilege-escalationserver-sidecommand-executioncve-2026-76298