Vulnpedia
← All CVEs

CVE-2026-76404

CRITICAL 9.1

Published 2026-08-19 · Last modified 2026-08-20

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

ELEVATED IMPACT

Severe if exploited (CVSS 9.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.6%chance of exploitation in 30 days · 44th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

9.1CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires an admin / high-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-76404/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-76404/poc.json

Affected

Vendors Splunk

Products Splunk Mcp Server App

Weakness (CWE)

  • CWE-502: The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

All CVSS metrics

  • CRITICAL 9.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

Technical & other

Sources: NVD · CVE.org · EPSS