Vulnerability · Published Aug 19, 2026 · Assigned by cisco

CVE-2026-76399Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit

High 8.1

In plain English

A high-severity incorrect permission assignment in Splunk AI Toolkit from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. The vulnerability is possible because Splunk AI Toolkit gives the "power" Splunk role permission to modify scheduled searches that run using the permissions of the search owner.

Affected products (as reported)

Vendor	Product	Versions
Splunk	Splunk AI Toolkit	6.0 – before 6.0.1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://advisory.splunk.com/advisories/SVD-2026-0808