Splunk Enterprise: Improper access control in scheduled search safeguards

Summary

Splunk Enterprise does not apply the SPL safeguards for risky commands to scheduled searches. A user with a role that holds the schedule_search capability can bypass these safeguards and run risky SPL commands. This can disclose or alter Splunk Enterprise data or disrupt the availability of the platform. The attacker needs a valid account with that capability; no user interaction is required.

Affected

• Splunk Enterprise 10.4.0 to before 10.4.4
• Splunk Enterprise 10.2.0 to before 10.2.8
• Splunk Enterprise 10.0.0 to before 10.0.11
• Splunk Enterprise 9.4.0 to before 9.4.16

Fixed in

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16

Workaround

• Unknown. No vendor-documented workaround specific to this CVE was found.
• Reducing the number of roles with the schedule_search capability lowers the exposed population while patching, but it is not a documented fix.

Exploitation

• Splunk reports no exploitation in the wild.
• No public proof-of-concept found.
• Not listed in the CISA KEV catalogue at the time of the research.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 (or higher) in the next maintenance window, together with the October 2026 bundle.
• Review which roles hold the schedule_search capability and remove it where it is not needed.
• Make sure Splunk Web and the management interface are not reachable from the internet.
• Monitor scheduled searches and audit logs for unusual SPL commands.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk Advisory SVD-2026-1007 advisory.splunk.com
• Splunk SPL safeguards for risky commands (commands that trigger safeguards) help.splunk.com
• Splunk Advisory SVD-2026-0801 advisory.splunk.com
• CryptiKa: Splunk fixes 24 security flaws www.cryptika.com
• Strix AI CVE-2026-76291 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:04.