Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Splunk AI Toolkit flaw allows arbitrary command execution

Part of the CVE-2026-20266 story · since 17 Jun

Quiet for 11 weekslast report 20 Aug3 articles2 outlets
17 Jun · SecurityOnline first28 Aug21 SepNowThis article1st of 3
  • Wed 17 Jun, 20:12 UTC. SecurityOnline, first report. Splunk AI Toolkit flaw allows arbitrary command execution. This article, 1st of 3.
  • Thu 18 Jun, 11:11 UTC. SecurityWeek, its first report on the story. Atlassian, Splunk release patches for critical AI Toolkit flaw.
  • Thu 20 Aug, 05:20 UTC. SecurityOnline. Splunk patches AI Toolkit OS command injection flaw CVE-2026-20266.

The Splunk AI Toolkit has two critical vulnerabilities: CVE-2026-20266, an OS Command Injection issue rated at CVSS 9.1, and CVE-2026-20265, an insecure default domain allowlist rated at CVSS 4.3. Patches are available in version 5.7.4. The OS Command Injection allows attackers to execute arbitrary commands on the host, while the second flaw can lead to data exfiltration. Organizations are urged to update to the latest version immediately to mitigate risks.

How the story developed

All 3 articles
Quiet for 11 weekslast report 20 Aug3 articles2 outlets

3 articles from 2 outlets since 17 Jun. Quiet since 20 Aug. This was the first report.

Now17 Jun18192019 Aug211 NovFirst reportSecurityOnline · 17 Jun, 20:12Picked up againafter 9 weeks quiet
  • Wed 17 Jun, 20:12 UTC. SecurityOnline, first report. Splunk AI Toolkit flaw allows arbitrary command execution. This article, 1st of 3.
  • Thu 18 Jun, 11:11 UTC. SecurityWeek, its first report on the story. Atlassian, Splunk release patches for critical AI Toolkit flaw.
  • Thu 20 Aug, 05:20 UTC. SecurityOnline. Splunk patches AI Toolkit OS command injection flaw CVE-2026-20266.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Wed 17 JunDay 01
    1. Splunk AI Toolkit flaw allows arbitrary command execution20:12 · SecurityOnline · First report · This article, 1st of 3
  2. Thu 18 JunDay 11
    1. Atlassian, Splunk release patches for critical AI Toolkit flaw11:11 · SecurityWeek

  3. Quiet for 9 weeks

    Thu 20 AugDay 641
    1. Splunk patches AI Toolkit OS command injection flaw CVE-2026-2026605:20 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in