Vulnerability intelligence

CVE-2026-76404

Splunk Splunk MCP Server app CWE-502

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

0.7%

Riskier than 53% of all CVEs · checked 2026-10-02

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories