Advisories
Splunk Issues Security Hardening Release for Multiple Apps and Add-ons (SVD-2026-0808)
Splunk has published a security hardening advisory addressing multiple vulnerabilities affecting several enterprise apps and add-ons, including the Splunk AI Toolkit and Cisco Talos Intelligence integration. Defenders must review the advisory details and update affected components immediately to mitigate high-severity risks such as RCE and SSRF.
What Happened
Splunk has released a security hardening update (Advisory ID: SVD-2026-0808) targeting multiple vulnerabilities across several core apps and add-ons. The highest severity score associated with this advisory is 9.1 (Critical), impacting components utilized for threat intelligence, AI integration, data streaming, and incident management.
Impacted Products and Affected Versions
SecOps and sysadmins administering Splunk environments should immediately check their instances for the following vulnerable packages and versions:
- Cisco Talos Intelligence for Enterprise Security Cloud: Version 1.0 (affected: below 1.0.3)
- Splunk AI Toolkit: Version 6.0 (affected: below 6.0.1) and Version 5.7 (affected: below 6.0.0)
- Splunk Connect for Kafka: Version 2.2 (affected: below 2.2.7)
- Splunk MCP Server app: Version 1.2 (affected: below 1.2.1)
- Splunk On-Call (VictorOps): Version 1.0 (affected: below 1.0.43)
Key Vulnerabilities
The advisory encompasses several notable security flaws, requiring prompt remediation to prevent exploitation:
- CVE-2026-76389: Server-Side Request Forgery (SSRF) via the REST API in Cisco Talos Intelligence (CVSS 8.8, High).
- CVE-2026-76395: Remote Code Execution (RCE) via deserialization of untrusted data in the Splunk AI Toolkit model loading REST API (CVSS 8.8, High).
- CVE-2026-76391 & CVE-2026-76394: Improper privilege management and missing authorization flaws within the Splunk AI Toolkit (CVSS 8.3, High).
- Additional medium and high-severity flaws involving hard-coded credentials, race conditions, information disclosure, and improper access controls across the AI Toolkit and other listed packages.
What Defenders Should Do
Administrators must apply the vendor-provided patches immediately by upgrading each affected app or add-on to its corresponding fixed version. Review the complete vendor advisory for granular CVE mappings and product-specific remediation paths.
Action Required: Upgrade Cisco Talos Intelligence to v1.0.3, Splunk AI Toolkit to v6.0.1 (or v6.0.0 depending on the base branch), Splunk Connect for Kafka to v2.2.7, Splunk MCP Server app to v1.2.1, and Splunk On-Call to v1.0.43.
Related vulnerabilities
Apple Unveils iPadOS 27.0 RC (24A435) – Early Access for Developers
Apple rolled out the iPadOS 27.0 Release Candidate (24A435) on September 9, 2026, giving developers a preview of the next major OS. While the official release notes are still sparse, the RC is expected to bring new APIs, UI refinements, performance tweaks, and critical bug fixes. Developers can download the build via TestFlight, test their apps, and report any issues back to Apple. The release marks another step toward the full 27.0 launch later this year.
Read briefing
Splunk Delays Security Advisories to October 7, 2026 – Update on Enterprise, Forwarder, AWS Add‑On, MCP Server
Splunk PSIRT has postponed the release of its September 16, 2026 vulnerability advisories to October 7, 2026. The advisories will cover Splunk Enterprise, Universal Forwarder, AWS Add‑On, and MCP Server. Defenders should download and install the latest versions of these products immediately.
Read briefing
Splunk Secure Gateway RCE via Unsafe Deserialization (SVD-2026-0601)
A low‑privileged user can execute arbitrary code on Splunk Enterprise and Cloud Platform instances by sending crafted JSON to the Secure Gateway app. The flaw exists in Splunk versions prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13, and corresponding Cloud and Secure Gateway releases. Defenders should upgrade immediately or apply the vendor’s patch and restrict access to the Secure Gateway app.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of 972 security fixes, including 113 critical issues and two zero‑days that had already been weaponized. The updates span Windows, Office, and other key Microsoft products, underscoring the urgency for rapid patch deployment across all environments.
Read briefing