Splunk patches 24 flaws, four critical, in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
62
CVE-2026-76291
Risky SPL safeguard bypass in Splunk Enterprise scheduled searches
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
In affected Splunk Enterprise versions, the search scheduler does not apply SPL safeguards for risky commands to scheduled searches. A user who already holds a role with the schedule_search capability can bypass those safeguards over the network without further interaction and run risky SPL that discloses or changes Splunk Enterprise data or disrupts availability.
What to do: Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16, matching the installed release line.
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 | 10.4.4, 10.2.8, 10.0.11, and 9.4.16 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation. For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.