CVE-2026-76404Patch(splunk / model_context_protocol_server)

🚨 CVE-2026-76404: Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app Critical Vulnerability Alert! Splunk is affected by CVE-2026-76404. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-76404 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-76404" Search Dork: Splunk Exposure: 1.5m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=U3BsdW5r&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260820 #Infosec #CyberSecurity #ZoomEye #DarkEye 🚀 ZoomEye continues to expand its AI ecosystem. Today we're introducing WebMCP support, enabling compatible AI agents to discover and invoke ZoomEye tools directly from the website. Explore our AI ecosystem: 1⃣ WebMCP 2⃣ MCP Server →（http://github.com/zoomeye-ai/mcp…） 3⃣ AI Skills →（http://ai.trusttools.cn/skills/zoomeye…） Building an AI-native cybersecurity platform. #Infosec #CyberSecurity #ZoomEye #DarkEye

Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons. #Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow https://securityonline.info/splunk-apps-cve-2026-76404/

Warning: #Splunk fixed multiple vulnerabilities, including critical Remote Code Execution (#RCE) CVE-2026-76313 (CVSS 9.4) & CVE-2026-76404 (CVSS 9.1). https://advisory.splunk.com/ #Patch #Patch #Patch

Splunk MCP Server などの 17 件の脆弱性が FIX：Across AI Toolkit と Kafka Apps の欠陥も修正 https://iototsecnews.jp/2026/08/20/splunk-patches-critical-mcp-server-rce-and-16-other-security-flaws-across-ai-toolkit-kafka-apps/ Splunk 各種アプリおよびアドオンに存在する、脆弱性 CVE-2026-76404／CVE-2026-76395／CVE-2026-76402 などの動向と対策を解説する記事です。この件の背景にあるのは、デシリアライズ処理の制御不備やアクセス制御の検証不足です。この不備により、リモートからの任意コード実行／認証クレデンシャルの流出／検索所有権限の改ざんといった影響が生じる恐れがあります。対応策として、指定バージョンへの迅速な更新／管理用 API へのアクセス制限／ロール割り当ての再評価が求められます。 #Across AI Toolkit #CVE202676389 #CVE202676391 #CVE202676394 #CVE202676395 #CVE202676396 #CVE202676397 #CVE202676399 #CVE202676402 #CVE202676403 #CVE202676404 #KafkaApps #MCPServer #Splunk #Vulnerability

Enterprise MCP just crossed a threshold: the first critical CVE in a vendor-backed MCP server. CVE-2026-76404. CVSS 9.1. Splunk MCP Server app, versions below 1.2.1. The flaw: the app's credential management component deserializes stored data without checking what it actually is. A user holding the admin Splunk role can execute arbitrary commands on the underlying operating system. To be precise: this is not unauthenticated. You need admin. The severity is not the entry bar. It is the location. MCP is the connector layer. It is where agents touch production logs, run queries, and feed incident response workflows. A deserialization bug there is a very old software failure showing up in a very new place. Docker surveyed 800 plus developers this year: 85 percent of teams know MCP, 40 percent call security the number one blocker for scaling agents. The 40 percent were not being paranoid. They were early. The fix is out: 1.2.1. What is your bar for letting an integration layer this young touch production data?

SplunkのMCP Serverアプリに深刻なリモートコード実行の脆弱性（CVE-2026-76404、CVSS 9.1）が発覚 CVE-2026-76404: Critical Remote Code Execution Hits Splunk MCP Server App (CVSS 9.1)　#DailyCyberSecurity (Aug 20) https://securityonline.info/splunk-apps-cve-2026-76404/

New RCE in Splunk MCP app (CVE-2026-76404). Via untrusted data deserialization. If you run it, patch now.

🚨Critical - Splunk MCP Server app unsafe deserialization → OS command execution (CVE-2026-76404) A user holding the admin Splunk role can execute arbitrary commands on the underlying OS, because the app's credential management component deserializes stored data without validating that the content is of the expected type. Scope-changed — code runs outside the Splunk app boundary, at host level. 👉Affected: Splunk MCP Server app < 1.2.1 | Upgrade to 1.2.1