CVE-2026-76404 - Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app · CoreCVE

Back Back to CVE browser

CRITICAL

Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

Published Aug 19, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.75%

Description

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

Affected products

Vendor Splunk Product Splunk MCP Server app Default
n/a
- Version
  1.2
  Status
  affected
  Constraints
  <1.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Splunk MCP Server app

n/a

Version	Status	Constraints
1.2	affected	<1.2.1

Remediation

Vendor solution

Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

https://advisory.splunk.com/advisories/SVD-2026-0808
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62969
Advisory

Link	Providers	Tags
https://advisory.splunk.com/advisories/SVD-2026-0808		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62969		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cisco

Published Aug 19, 2026

Updated Aug 20, 2026

Reserved Aug 19, 2026

Link CVE-2026-76404

CISA Vulnrichment

Updated Aug 20, 2026

Status Analyzed

Modified Aug 24, 2026

Link CVE-2026-76404

Severity n/a

Public date n/a

Links CVE-2026-76404

Assigner cisco

Published Aug 19, 2026

Updated Aug 20, 2026

Exploited since n/a

Link EUVD-2026-62969

EUVD-2026-62969