CVE-2026-76253
CVE-2026-76253: 1 tracked advisory record across Splunk. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Splunk
1 advisory- Advisory severityHigh8.8
High [CVE-2026-76253] Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise
CVE-2026-76253Source published Source updated
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability. The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions. For more information see Create scheduled alerts ( ), Set up alert actions ( ), Define roles on the Splunk platform with capabilities ( ), and Configuration file precedence ( ) in the Splunk…
- Affected products in this advisory
- Splunk Enterprise
- Source-reported affected versions
- Splunk Enterprise 10.4 before 10.4.2
- Splunk Enterprise 10.2 before 10.2.6
- Splunk Enterprise 10.0 before 10.0.9
- Splunk Enterprise 9.4 before 9.4.14
- Source-reported fixed versions
- 10.4.2
- 10.2.6
- 10.0.9
- 9.4.14
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- The vulnerability is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions.
Android app · Google Play
Monitor future Splunk CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.