Splunk discloses 92 CVEs across Enterprise, AI Toolkit, MCP and SOAR

Splunk published three large security-hardening groups on 19 August 2026: 60 CVEs for Splunk Enterprise, 15 for Splunk SOAR and 17 for applications and add-ons. That makes 92 CVE identifiers in the main advisories. The scope includes remote code execution, authorisation defects, SPL and SQL injection, path traversal, token exposure and unsafe deserialisation in Splunk AI Toolkit and Splunk MCP Server.

The number does not mean 92 unauthenticated RCEs. Many findings require a role, capability, enabled feature or user interaction, and some carry medium or low impact. Delay is still risky. Splunk often stores an organisation’s most sensitive logs, integration tokens and incident-response evidence. Compromise of a defensive platform can reduce visibility and permit evidence modification.

SVD-2026-0801: 60 Splunk Enterprise issues

“Security Hardening Release for Splunk Enterprise — August 2026” has a highest CVSS score of 9.4. Splunk lists fixed releases 10.4.2, 10.2.6, 10.0.9 and 9.4.14. Compare the deployed product to the affected-version matrix; being on branch 10.4 is insufficient if the instance is 10.4.0 or 10.4.1.

Three critical entries, CVE-2026-76310, CVE-2026-76311 and CVE-2026-76312, concern improper access control for embedded reports, their dispatch archives and related paths. The 9.4 score reflects severe confidentiality, integrity and availability impact in the documented context. Teams should identify use of embedded reports rather than assuming only administrators are exposed.

RCE findings include CVE-2026-76313 through the REST API, CVE-2026-76314 and CVE-2026-76335 through Splunk Web Manager configuration, and CVE-2026-76319 through Federated Search. CVE-2026-76345 also describes REST API RCE but has different prerequisites and a lower score. A shared “RCE” label does not create a shared exposure path.

The advisory also contains many SPL injection, SQL injection, path traversal, XSS, SSRF and token issues. Findings around knowledge bundles, search head clustering, distributed search and alert configuration matter particularly because they operate in a multi-node environment and may cross a single search head’s boundary.

Additional work for selected CVEs

Splunk states that upgrading alone does not completely remedy CVE-2026-76338 and CVE-2026-76352; additional steps are required in their detailed entries. This is a common automation trap: a scanner observes a fixed version while configuration, a token or historical state remains risky.

A playbook needs to read “Mitigations and Workarounds” per CVE rather than only the version table. If a flaw could expose a token or permit improper authorisation, closure may require credential invalidation, role review, key regeneration or removal of an old artefact. Completion evidence covers both version and post-upgrade action.

SVD-2026-0804: 15 Splunk SOAR CVEs

Splunk SOAR has a separate 15-CVE hardening release and an upgrade to 8.6.0. The highest score in the group is 8.1. CVE-2026-76356 describes an authentication bypass involving IP spoofing. CVE-2026-76357 concerns RCE through path traversal. CVE-2026-76363, 76364 and 76365 are SQL injection issues, while CVE-2026-76366 can disclose a session token.

SOAR is not just a dashboard. It runs playbooks and connects to EDR, email, cloud, firewalls and ticketing. Platform identities can isolate endpoints, block accounts, retrieve messages and alter policies. Even a defect requiring an authenticated user can have major impact when that user’s role can trigger automation.

After upgrading, review application tokens, service identities and playbook history. Suspicious execution may not appear as a child process on the SOAR host; it may be a valid API call to an external system made in the wrong context.

SVD-2026-0808: AI Toolkit and unsafe pickle

The applications and add-ons group contains 17 CVEs. CVE-2026-76395 in Splunk AI Toolkit scores 8.8 and involves untrusted pickle deserialisation while handling a sparse matrix. A user with the power role could cause code execution. The fix is in AI Toolkit 6.0.1; disabling or removing the app is the mitigation where upgrading is not possible.

Pickle stores Python object graphs and may invoke functions when reconstructing them. An isinstance check after deserialisation is too late: code may already have run. A model, experiment or matrix file needs to be treated as an executable artefact. Safer array formats and explicit schemas reduce this class of risk, while still needing size limits and parser hardening.

CVE-2026-76399 in AI Toolkit illustrates another boundary. A power user could modify app-provided scheduled searches and run arbitrary SPL with the search owner’s permissions. This is a confused deputy: the platform performs a valid operation with data and context chosen by a less privileged actor.

CVE-2026-76404: critical Splunk MCP Server RCE

CVE-2026-76404 scores 9.1 and affects Splunk MCP Server app below 1.2.1. A user holding the admin role could execute arbitrary operating-system commands. Missing validation in the credential-management component allowed stored data to be deserialised without confirming its expected type.

The administrator prerequisite reduces casual entry probability but not impact. A Splunk administrator should not automatically be an operating-system administrator. The flaw breaks separation of duties and converts compromise of an application account into host execution.

Upgrading MCP Server to 1.2.1 is the baseline. Establish whether the app host has tokens for indexes, a vault, external systems and peer search heads. Where evidence indicates abuse, rotate the complete graph of credentials reachable by the process, not just the Splunk user’s password.

Other applications and add-ons

The bulletin includes Splunk Connect for Kafka, Splunk On-Call and other extensions. Connect for Kafka 2.2.7 addresses retry, ReDoS, SSRF and certificate-validation issues. Splunk On-Call 1.0.43 fixes API-key storage. Every app has its own release cycle, independent of Splunk Enterprise.

Updating core to 10.4.2 does not automatically upgrade AI Toolkit, MCP Server or the Kafka connector. A CMDB needs a per-instance application and version list. Search head clusters require a consistent bundle and controlled deployment; a manual edit on one node may be overwritten.

Prioritise by path, not CVSS alone

First map internet-reachable surfaces: Splunk Web, REST, the management port, embedded reports, SOAR APIs and connectors. Next map admin, power, custom capabilities, automation accounts and user tokens. The third layer is topology: search head clusters, indexers, deployment servers, heavy forwarders, federated search and applications.

A practical sequence is:

update externally reachable Enterprise to its supported fixed release;
deploy SOAR 8.6.0 and validate application connections;
update AI Toolkit to 6.0.1 and MCP Server to 1.2.1, or disable them;
complete the extra actions for CVE-2026-76338 and 76352;
review roles, capabilities, scheduled searches and object owners;
rotate tokens indicated by access evidence or the flaw class;
redeploy the corrected bundle to every node and confirm runtime versions.

During transition, restrict management and REST interfaces to administrative networks, disable unused apps and separate human users from service identities. Do not test RCE or deserialisation on production. Validate through version, configuration, synthetic lab data and log review.

Hunting after the upgrade

Look for Manager configuration changes, unusual scheduled-search creation or modification, REST calls by roles that rarely make them, deserialisation errors and child processes spawned by the Splunk service. Correlate with file changes under $SPLUNK_HOME, outbound connections, token issuance and activity in integrated systems.

For SOAR, review playbooks outside normal schedules, new assets, credential changes and destructive actions. For AI Toolkit, examine artefact imports, experiment history and power-role execution. For MCP, inspect credential-management operations and OS processes correlated with app requests.

Vendor facts and Breachroad conclusions

The 60, 15 and 17 counts, fixed releases, required roles and CVE descriptions come from Splunk’s advisories. There is no basis for presenting all 92 as one unauthenticated campaign. Topology-based prioritisation, credential-graph rotation and hunting rules are Breachroad conclusions.

Because SIEM and SOAR form part of the defence, owners should rehearse updates without losing telemetry. Cybersecurity training for organisations aligns SOC, platform and administration teams, while an IT security audit can verify roles, segmentation, applications and patch evidence.