Splunk Enterprise August 2026 hardening release (SVD-2026-0801): three unauthenticated CVSS 9.4 flaws let anyone holding an embedded-report token hijack the report owner's session, admins included

Splunk Enterprise August 2026 hardening release (SVD-2026-0801): three unauthenticated CVSS 9.4 flaws let anyone holding an embedded-report token hijack the report owner's session, admins included

Splunk's SVD-2026-0801, published 2026-08-19, fixes 60 CVEs across Splunk Enterprise 10.4.0–10.4.1 (→10.4.2), 10.2.0–10.2.5 (→10.2.6), 10.0.0–10.0.8 (→10.0.9) and 9.4.0–9.4.13 (→9.4.14). The headline is a trio of unauthenticated CVSS 9.4 flaws (CWE-284, Improper Access Control) in Splunk's embedded-report feature: CVE-2026-76310 (Embedded Report REST API Requests), CVE-2026-76311 (Embedded Report Dispatch Archives) and CVE-2026-76312 (Embedded Reports generally). Splunk's own description of the mechanism is precise about the impact: "an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the 'admin' Splunk role" (Splunk, SVD-2026-0801, 2026-08-19). CVE-2026-76312's variant needs no token at all — reading the HTML source of any page that embeds a Splunk report is enough. Splunk's stated mitigation is allowEmbedTokenAuth = false in server.conf where embedding is unused, or turning off Splunk Web entirely for the -76312 variant.

Because Splunk is itself the SIEM many organisations run their own detection on, a session-hijack path into it is a path into the detection estate — an attacker who recovers an admin-owned embedded report's session material can act with that report owner's privileges inside the platform responders rely on to see everything else. That elevates this above an ordinary product-patch cycle regardless of Splunk's own severity framing.

Three further high-severity items round out the batch. CVE-2026-76350 (CVSS 8.8, CWE-269) lets any user holding only the schedule_search capability configure a PDF-attachment email-alert action that Splunk's scheduler then renders under a system-level authentication context rather than the action owner's: "a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges" (Splunk, SVD-2026-0801, 2026-08-19) — a low-privileged, schedule-only role escalating to system-wide data exposure. CVE-2026-76253 (also CVSS 8.8, CWE-269) is the same privilege class reaching further: a schedule_search-only role can run arbitrary SPL commands with the highest level of system privilege through scheduled-search alert-action configuration, because the search scheduler does not properly restrict user-specific alert-action settings before running them — "a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability" (Splunk, SVD-2026-0801, 2026-08-19). CVE-2026-76351 (CVSS 8.8) is an SSRF in the Secure Gateway Report Notification REST API reachable with only schedule-level privilege, minting a system-level session token with no password. Five further RCE-class CVEs (knowledge-bundle upload, Web Manager configuration XML evaluation, federated search) and a stored-credential-exposing SPL injection via the geostats command round out the release; none is reported exploited.

Detection concentrates on the two access paths Splunk itself names. For the embedded-report trio: audit which reports currently have embedding enabled and who owns them, and treat any dispatch-archive download request that does not originate from Splunk's own scheduler or an authenticated interactive session as suspect — legitimate embedded-report viewing never needs the underlying dispatch archive directly. Triage: a normal embedded-report view renders through the web tier and never touches the raw dispatch archive path; a request that goes straight for the archive, or that arrives with a token but no corresponding active browser session, is the discriminator. For CVE-2026-76350, review scheduled email-alert actions for PDF-attachment configuration owned by low-privileged accounts — the presence of that configuration on an account holding only schedule_search is itself the anomaly, since the feature's system-level execution context was not intended for that privilege level.