CVE-2026-76350
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.
How to fix
- splunk splunk9.4.14, 10.0.9, 10.2.6, 10.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk splunk | 9.4.0 ≤ v < 9.4.14, 10.0.0 ≤ v < 10.0.9, 10.2.0 ≤ v < 10.2.6, 10.4.0 ≤ v < 10.4.2 | 9.4.14, 10.0.9, 10.2.6, 10.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.