CVE-2026-76350— Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise
Quick assessment
Affected
Splunk Splunk Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Splunk Enterprise 10.4.2、10.2.6、10.0.9 和 9.4.14 之前的版本中，拥有 schedule_search 权限的用户可以在电子邮件告警操作工作流中配置可移植文档格式（PDF）附件。当电子邮件告警操作执行时，系统可能会以系统级特权执行任意搜索处理语言（SPL）命令，暴露所有相关数据，并影响搜索头（Search Head）的系统完整性和可用性。 该漏洞之所以存在，是因为在渲染 PDF 附件时，搜索调度程序传递的是系统级认证上下文，而非告警操作所有者的认证上下文。 有关更多信
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4< 10.4.2 |
affected |
10.2< 10.2.6 |
affected | ||
10.0< 10.0.9 |
affected | ||
9.4< 9.4.14 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise
Source: CVE Program / CVE List V5
Vulnerability Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4 ~ 10.4.2 | - |
|
II. Public POCs for CVE-2026-76350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76350
请登录查看更多情报信息。
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76259 | 8.8 HIGH | Improper Privilege Management on the Management Port in Splunk Enterprise for Windows |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
| CVE-2026-76402 | 8.2 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Splunk Enterprise
-
CVE-2026-76355
Unauthenticated Information Disclosure through an Edge Proce -
CVE-2026-76353
Path Traversal through Knowledge Bundle Replication in Splun -
CVE-2026-76354
Path Traversal through Search Head Clustering in Splunk Ente -
CVE-2026-76352
Improper Authorization through the REST API in Splunk Enterp -
CVE-2026-76351
Server-Side Request Forgery (SSRF) through the Report Notifi
Same vendor: Splunk
-
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector -
CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru -
CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST -
CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S
Same weakness: CWE-269
-
CVE-2026-16149
Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Pri -
CVE-2026-19883
WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscr -
CVE-2026-53527
LeafWiki Vulnerable to Privilege Escalation via User Self-Se -
CVE-2026-59799
Apache CloudStack: Missing Privilege Check in Two-Factor Aut -
CVE-2026-17145
Vulnerabilities in IBM AIX and PowerVM VIOS
V. Comments for CVE-2026-76350
No comments yet