CVE-2026-76396

Received Received - Intake

Deserialization Flaw in Splunk AI Toolkit

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply search command as risky. For more information see Troubleshoot the AI Toolkit (https://help.splunk.com/en/splunk-enterprise/apply-machine-learning/use-ai-toolkit/5.7.3/troubleshooting-the-ai-toolkit/troubleshoot-the-ai-toolkit) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76396

EUVD

EUVD-2026-62961

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_ai_toolkit	to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

In Splunk AI Toolkit versions below 6.0.0, a user with a role that has the schedule_search capability can exploit a vulnerability by causing a scheduled search to load and deserialize a model file through the apply search command. This happens because the AI Toolkit does not mark the apply search command as risky, leading to improper access control.

Impact Analysis

This vulnerability could allow an attacker with specific permissions to execute arbitrary code or gain elevated privileges on the Splunk system. It may lead to unauthorized access, data breaches, or disruption of services if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Splunk versions may face legal and financial penalties for non-compliance.

Mitigation Strategies

Upgrade Splunk AI Toolkit to version 6.0.0 or later to address the improper access control in the apply search command.

Hi! I’m here to help you understand CVE-2026-76396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70