Is CVE-2026-76291 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76291 being exploited in the wild.

How severe is CVE-2026-76291?

High severity, with a CVSS score of 8.8, published 21 October 2026.

Which products and versions are affected?

Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.

Is there a fix for CVE-2026-76291?

Yes: fixed in Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76291 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76291?

Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76291: Splunk Enterprise improper access control in scheduled search safeguards

CVE-2026-76291 · Severity: high · CVSS 8.8 · Published 2026-10-21

Splunk Enterprise, a data analytics platform used to search and analyze machine-generated data, contains a flaw where users with the ability to schedule searches can bypass safety protections designed to prevent risky operations. An attacker with this capability could execute dangerous search commands that expose, modify, or destroy data in Splunk, or cause the system to stop working.

Technologies: Splunk Enterprise. Vendors: Splunk.

Quick answers

Is CVE-2026-76291 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76291 being exploited in the wild.
How severe is CVE-2026-76291?: High severity, with a CVSS score of 8.8, published 21 October 2026.
Which products and versions are affected?: Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
Is there a fix for CVE-2026-76291?: Yes: fixed in Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76291 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76291?: Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16

Technical details

A user holding the schedule_search capability can bypass SPL safeguards for risky commands by scheduling searches, since the Splunk Enterprise search scheduler does not apply these protections to scheduled searches as it does to ad-hoc searches. The vulnerability requires prior authentication and the specific capability assignment, allowing an authenticated attacker to disclose or alter data or disrupt availability.

Affected products

Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16

Timeline

2026-10-21: disclosed

References

https://advisory.splunk.com/advisories/SVD-2026-1007

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.