CVE-2026-76398 is a medium severity vulnerability in Splunk AI Toolkit versions 6.0 and 6.0.0 prior to 6.0.1. It allows users without admin or power roles to delete another user's experiment history via the REST API due to missing authorization checks before deletion. This flaw arises because the toolkit deletes experiment history before verifying user permissions.
CVE-2026-76397 affects Splunk AI Toolkit versions before 6.0.0 and allows users with the "power" role to access and delete experiment history data belonging to other users by modifying key values. This occurs because the toolkit does not maintain trusted experiment scope when handling caller-controlled query parameters. The vulnerability has a high severity with a CVSS score of 8.1.
CVE-2026-76396 is a high-severity vulnerability in Splunk AI Toolkit versions 5.7 up to but not including 6.0.0. It involves improper access control where a user with the schedule_search capability can cause a scheduled search to load and deserialize a model file via the apply search command. This occurs because the apply search command is not marked as risky, allowing unintended privilege escalation.
CVE-2026-76395 is a high-severity vulnerability in Splunk AI Toolkit versions 5.7 up to but not including 6.0.0. It allows users with the 'power' Splunk role to execute arbitrary code on the Splunk server by loading a specially crafted model file containing malicious sparse matrix data. This occurs because the model codec deserializes untrusted data without properly verifying or guarding against embedded pickle content.
CVE-2026-76394 is a high-severity vulnerability in Splunk AI Toolkit versions 5.7 up to but not including 6.0.0. It allows low-privileged users without admin or power roles to start, stop, and configure containers and read or modify connection and configuration data via the REST API due to missing authorization checks.
A race condition vulnerability exists in Splunk AI Toolkit versions 5.7 up to but not including 6.0.0. This flaw allows a user who can upload models to overwrite a model being uploaded by another user by sending concurrent upload requests with the same model name. The vulnerability arises because the toolkit does not verify that the uploaded content corresponds to the request creating the model lookup entry, potentially causing the lookup to reference attacker-controlled content.
CVE-2026-76392 is a medium severity vulnerability in Splunk AI Toolkit versions 5.7 and all versions from 5.7 up to but not including 6.0.0. It involves the use of hard-coded or predictable credentials for connected container services, which can be accessed by users without admin or power roles. This issue arises because the toolkit generates or stores credentials using default or predictable values, potentially allowing unauthorized access to these services.
CVE-2026-76391 is a high-severity vulnerability in Splunk AI Toolkit versions 5.7 up to but not including 6.0.0. It allows users without admin or power roles to execute searches with system-level privileges, access all relevant data, and manipulate or delete other users' search jobs via the Agent Run History feature. This occurs because the software improperly replaces the user session key with a system authentication token during search operations, bypassing intended access controls.
CVE-2026-76390 is a medium severity vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud versions 1.0 up to but not including 1.0.3. It allows unauthenticated users to access the add-on OpenAPI specification via Splunk Web static file paths. This exposure enables reconnaissance of REST API endpoints and the authentication model, potentially aiding attackers in understanding the API structure. The issue arises because the OpenAPI specification is served as a static file without authentication.
CVE-2026-76389 is a high-severity vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud versions 1.0 up to but not including 1.0.3. It allows a user with the get_talos_enrichment capability to send crafted requests to the Talos intelligence enrichment REST API endpoint, causing the instance to make outbound requests to attacker-controlled servers. This can lead to exposure of tokens that compromise data and system integrity in the affected Splunk instance.
CVE-2026-76388 affects Splunk Enterprise Security versions 8.6 up to but not including 8.6.1. It allows users with the ess_analyst role to modify UEBA search macros that run with administrator permissions, potentially granting access to sensitive data and system integrity. This occurs because analyst roles have write access to macros that should be restricted to administrators.
CVE-2026-76387 is a high-severity vulnerability in Splunk Enterprise Security versions 8.6 up to but not including 8.6.1. It allows users with the mc_investigation_read capability to inject Search Processing Language (SPL) commands via Analyst Queue search filters due to improper validation of filter field names. This can lead to unauthorized access to data and system integrity as permitted by the scheduled searches run for that user.
CVE-2026-76386 affects the Zoom app for Splunk SOAR versions 3.2 and 3.2 up to but not including 3.2.2. The vulnerability involves the storage and display of sensitive meeting and personal meeting ID passwords in cleartext within the user interface. This occurs because the app does not mask the password parameters in certain actions, allowing users with permission to run actions to view these passwords. The CVSS score is 4.3, indicating a medium severity information disclosure issue.
CVE-2026-76385 affects the Venafi app for Splunk SOAR versions 2.1 and all versions from 2.1 up to but not including 2.1.4. The vulnerability involves the exposure of sensitive information such as keystore and private-key passwords in cleartext within the user interface when a user with permission to run actions invokes the get certificate action. This occurs because the app does not mask the keystore_password and password parameters, failing to mark them as password fields.
CVE-2026-76384 affects the Splunk Attack Analyzer Connector for Splunk SOAR versions prior to 2.2.1. The vulnerability involves the exposure of a sensitive archive password in cleartext within the user interface when invoking certain actions. This occurs because the archive_password parameter is not masked or treated as a password field, allowing users with permission to run actions to see the password in cleartext. The issue is limited to versions below 2.2.1.
CVE-2026-76383 affects the RSA SecurID Authentication Manager app for Splunk SOAR versions 1.0 and 1.0.x prior to 1.0.5. The vulnerability involves the exposure of a sensitive token serial in cleartext within the user interface when a user with permission to run actions invokes the enable token or revoke token actions. This occurs because the token_serial parameter is not masked or treated as a password, leading to potential information disclosure.
CVE-2026-76382 affects the Phantom app for Splunk SOAR versions 3.8 and versions from 3.8 up to but not including 3.8.5. The vulnerability involves the exposure of a sensitive archive password in cleartext within the user interface when a user with permission to run actions invokes the deflate item action. This occurs because the password parameter is not masked or marked as a password field, leading to potential information disclosure.
CVE-2026-76381 affects the MS Graph for Active Directory app for Splunk SOAR versions 1.5 and 1.5.x prior to 1.5.2. The vulnerability allows users with permission to run actions to see a sensitive password in cleartext within the user interface when invoking the reset password action. This occurs because the app does not mask the temp_password parameter, which is not marked as a password field. The issue leads to information disclosure but does not affect integrity or availability.