CVE-2026-76397

HighCVSS 8.1/10Last modified Aug 21, 2026

Description

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Aug 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-763984.3In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history CVE-2026-763998.1In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbi CVE-2026-76406.4The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protec CVE-2026-764005.9In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764015.9In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764028.2In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764037.4In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant da CVE-2026-764049.1In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying o CVE-2026-764054.3In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could re CVE-2026-764065.9In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance CVE-2026-76407As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76408As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie