CVE-2026-76253

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions. For more information see Create scheduled alerts (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/create-alerts/create-scheduled-alerts), Set up alert actions (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.3/configure-alert-actions/set-up-alert-actions), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Configuration file precedence (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-splunk-enterprise-with-configuration-files/configuration-file-precedence) in the Splunk documentation.

• CWE-269

• https://advisory.splunk.com/advisories/SVD-2026-0801Mitigation, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Aug 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76242stigmem-node 0.9.0a1 accepts federation peer key material du…9.1
• CVE-2026-76243stigmem versions before 0.9.0a2 allow unauthenticated access…9.2
• CVE-2026-76244stigmem-node contains an insecure default configuration vuln…9.1
• CVE-2026-76245stigmem (pip package stigmem-node) version 0.9.0a1 contains …7.1
• CVE-2026-76251In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0…7.1
• CVE-2026-76252In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.1
• CVE-2026-76254In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …8.8
• CVE-2026-76255In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, …7.3
• CVE-2026-76256In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …4.3
• CVE-2026-76257In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76258In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76259In Splunk Enterprise for Windows versions below 10.4.2, 10.2…7.8