Vulnerability in Splunk Enterprise

[ Description ]Official description

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation. For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1366

  Multiple vulnerabilities in Splunk products Translated from French

  Multiple vulnerabilities have been discovered in Splunk products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and remote cross-site scripting (XSS).

  CVE-2026-76298CVE-2026-42308CVE-2026-76295+108 more CVEs
• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4102

  Splunk Splunk Enterprise: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-76294CVE-2026-76289CVE-2026-76300+13 more CVEs

[ References ]References

• advisory.splunk.com/advisories/SVD-2026-1007