CVEFinder.io

CVE-2026-76253

⚠️ high
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does no

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions. For more information see Create scheduled alerts (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/create-alerts/create-scheduled-alerts), Set up alert actions (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/configure-alert-actions/set-up-alert-actions), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Configuration file precedence (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-splunk-enterprise-with-configuration-files/configuration-file-precedence) in the Splunk documentation.

CVSS Score
8.8
High
EPSS Score
0.4
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 349,016 vulnerabilities in our database.

#66,974
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 20, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-08-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-269

📦 Affected Products 4

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.9
splunk splunk Affected
> 10.2.0 < 10.2.6
splunk splunk Affected
> 10.4.0 < 10.4.2
splunk splunk Affected
> 9.4.0 < 9.4.14

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0801
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-76251 ⚠️ high 7.1 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk r... 2026-08-19
CVE-2026-76252 🔶 medium 6.8 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user ... 2026-08-19
CVE-2026-76254 ⚠️ high 7.5 0.3 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause anot... 2026-08-19
CVE-2026-76255 🔶 medium 6.4 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" ... 2026-08-19
CVE-2026-76256 🔶 medium 4.3 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9,... 2026-08-19
CVE-2026-76257 🔶 medium 6.5 0.3 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10... 2026-08-19
These CVEs affect the same products