CVE-2026-76399
Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit
Severity
High 8.1
CVSS 3.1
Exploited
Not listed
EPSS
0.002
16.4th percentile
Discovered by
Not disclosed
Published
Aug 19, 2026
Assigned by cisco
Description
In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. The vulnerability is possible because Splunk AI Toolkit gives the "power" Splunk role permission to modify scheduled searches that run using the permissions of the search owner.
Weakness: CWE-732
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Apps & Add-ons | SIEM & Log Management | cna-assigner |
Vendor-reported products (1)
- Splunk · Splunk AI Toolkit
Vendor remediation
Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status.