Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Splunk Enterprise: Malicious PDFs Can Execute Commands with System Privileges

CVE-2026-76350 · published 2 months ago
Summary

A vulnerability in older versions of Splunk Enterprise allows a user with certain permissions to execute arbitrary commands with system-level privileges by attaching malicious PDFs to email alerts. This could compromise system integrity and availability. Update to the latest version of Splunk Enterprise, 10.4.2 or later, to fix this issue.

What to do
  • Update splunk splunk enterprise to version 10.4.2 or later.
Affected software
VendorProductAffected versions
splunk splunk enterprise < 10.4.2
splunk splunk >= 9.4.0, < 9.4.14
>= 10.0.0, < 10.0.9
>= 10.2.0, < 10.2.6
>= 10.4.0, < 10.4.2
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Original advisory text
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in th...
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published19 Aug 2026
Updated4 Nov 2026
First seen19 Aug 2026
Sources
CVE-2026-76350 · NVD
CVE-2026-76350 · MITRE
Track software like this
Free during beta