CVE-2026-76350 json
Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise
published 2026-08-19 2 mo ago modified 2026-08-21 2 mo ago also EUVD-2026-62915
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.
Patch / fix
- Splunk Splunk Enterprise 9.4.14, 10.0.9, 10.2.6, 10.4.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Splunk Splunk Enterprise
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
advisory.splunk.com
/advisories/SVD-2026-0801
vendor-advisory
Sources
- CVE List CVE-2026-76350
- NVD CVE-2026-76350
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.