Skip to content
Sign in

Splunk product

AI Toolkit

Alert
No AI Toolkit CVE is in the CISA KEV catalogue.

Tracked since 17 Jun · latest article 20 Aug · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No AI Toolkit CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds AI Toolkit CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a AI Toolkit CVE to KEV.

Fix listed

2 of 2 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-20266: 50.3th percentileCVE-2026-20265: 12.2th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-2026650.3
CVE-2026-2026512.2

Coverage3 articles · all time

The latest 3 articles naming AI Toolkit, in the shared story grammar.

Full timeline
Quiet for 10 weekslast report 20 Aug3 articles2 outlets

3 articles from 2 outlets since 17 Jun. Quiet since 20 Aug.

Now17 Jun18192019 Aug21First reportSecurityOnline · 17 Jun, 20:12Picked up againafter 9 weeks quiet
  • Wed 17 Jun, 20:12 UTC. SecurityOnline, first report. Splunk AI Toolkit flaw allows arbitrary command execution.
  • Thu 18 Jun, 11:11 UTC. SecurityWeek, its first report on the story. Atlassian, Splunk release patches for critical AI Toolkit flaw.
  • Thu 20 Aug, 05:20 UTC. SecurityOnline. Splunk patches AI Toolkit OS command injection flaw CVE-2026-20266.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Wed 17 JunDay 01
    1. Splunk AI Toolkit flaw allows arbitrary command execution20:12 · SecurityOnline · First report
  2. Thu 18 JunDay 11
    1. Atlassian, Splunk release patches for critical AI Toolkit flaw11:11 · SecurityWeek

  3. Quiet for 9 weeks

    Thu 20 AugDay 641
    1. Splunk patches AI Toolkit OS command injection flaw CVE-2026-2026605:20 · SecurityOnline · Picked up again

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-20266

    Splunk AI Toolkit vulnerability

    9.1Critical0.6% EPSS · 3 articles
  • CVE-2026-20265

    Insecure Default Domain Allowlist in Splunk AI Toolkit

    4.3Medium0.2% EPSS · 2 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in