CVE-2026-76253

🗓️ 19 Aug 2026 21:34:13Reported by ciscoType

Splunk Enterprise privilege escalation via scheduled search alert action config lets schedule_search users run SPL with full system privileges and read all stored credentials.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-76253	20 Aug 202604:45	–	circl
Cvelist	CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise	19 Aug 202621:34	–	cvelist
EUVD	EUVD-2026-63105	20 Aug 202600:34	–	euvd
NCSC	Splunk Enterprise’s vulnerabilities are exploited through Splunk	21 Aug 202608:16	–	ncsc
NVD	CVE-2026-76253	19 Aug 202622:17	–	nvd
Positive Technologies	PT-2026-78725	19 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise	19 Aug 202621:34	–	vulnrichment

NVD

Node

splunk splunkRange9.4.0–9.4.14enterprise

splunk splunkRange10.0.0–10.0.9enterprise

splunk splunkRange10.2.0–10.2.6enterprise

splunk splunkRange10.4.0–10.4.2enterprise

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.4.2"
      },
      {
        "version": "10.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.2.6"
      },
      {
        "version": "10.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.9"
      },
      {
        "version": "9.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.4.14"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2026-0801

27 Aug 2026 17:20Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.8

EPSS0.0035

SSVC

CWE-269