Several vulnerabilities were discovered in Splunk products and related apps, leading to the release of security updates.
The affected products are Cisco Talos Intelligence for Enterprise Security Cloud, Splunk AI Toolkit, Splunk Connect for Kafka, Splunk MCP Server app, and Splunk On-Call (VictorOps). – A total of 18 vulnerabilities have been addressed, including server-side request forgery (SSRF), information disclosure, improper authorization management, use of hard-coded credentials, race conditions, missing authorization validation, remote code execution, improper access control, improper privilege assignment, denial of service, regular expression denial of service (ReDoS), and improper certificate validation.
In Cisco Talos Intelligence for Enterprise Security Cloud, an SSRF vulnerability in the REST API (CVE-2026-76389) and an information disclosure vulnerability in Splunk Web (CVE-2026-76390) have been resolved.
In the Splunk AI Toolkit, the following vulnerabilities have been resolved: improper permission management in Agent Run History (CVE-2026-76391), use of hard-coded credentials (CVE-2026-76392), a race condition in the REST API (CVE-2026-76393), missing authorization validation (CVE-2026-76394), remote code execution in the model loading REST API (CVE-2026-76395), and inadequate access control in the scheduled search feature (CVE-2026-76396, CVE-2026-76399), and Inappropriate access control in the REST API (CVE-2026-76397, CVE-2026-76398) have been resolved.
In Splunk Connect for Kafka, a denial-of-service vulnerability in the REST API (CVE-2026-76400), ReDoS (CVE-2026-76401), SSRF (CVE-2026-76402), and improper certificate validation in the HTTP Event Collector Kerberos authentication process (CVE-2026-76403) in the REST API have been resolved.
A remote code execution vulnerability (CVE-2026-76404) in the Splunk MCP Server app and an information disclosure vulnerability (CVE-2026-76405) in Splunk On-Call (VictorOps) have been resolved.
The recommended latest versions are Cisco Talos Intelligence for Enterprise Security Cloud 1.0.3, Splunk AI Toolkit 6.0.1 and 6.0.0, Splunk Connect for Kafka 2.2.7, Splunk MCP Server app 1.2.1, and Splunk On-Call (VictorOps) 1.0.43. – Users of these products should update to the latest version with the Vulnerability Patch by following the instructions on the reference site.
