In Splunk AI Toolkit versions below 6.0.0, specifically version 5.7, the application deserializes untrusted sparse matrix data without sufficient validation, allowing a user with the 'power' Splunk role to execute arbitrary code on the server. The root cause is that a model codec deserializes sparse matrix data containing embedded pickle content without proper safeguards, leading to unsafe deserialization. This vulnerability is tracked as CVE-2026-76395 and has a CVSS 3.1 base score of 8.8, indicating high severity.

An attacker with the 'power' Splunk role can execute arbitrary code on the Splunk server, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the assignment of the 'power' Splunk role to trusted users only and avoid loading untrusted model files containing sparse matrix data. Monitor Splunk's official documentation and advisories for updates on patches or mitigations.