Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime

Summary This bulletin for IBM Semeru Runtime covers all applicable Java SE CVEs published by OpenJDK as part of their July 2026 Vulnerability Advisory, plus three further vulnerabilities. For more information please refer to OpenJDK's July 2026 Vulnerability Advisory and the CVE links below...

CVE-2026-76334

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

EUVD-2026-62961

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

CVE-2025-36255

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions...

CVE-2026-76398 Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76397

Splunk AI Toolkit versions below 6.0.0 are affected: a user with the "power" Splunk role can access and delete all experiment history data, including other users' data, because the tool does not preserve the trusted experiment scope when processing caller-controlled query values. CVSS 8.1 (HIGH) ...

CVE-2026-76398

Splunk AI Toolkit versions below 6.0.1 are affected by an improper access control vulnerability in the REST API. A user without the "admin" or "power" Splunk role can delete the experiment history of another user without authorization. The root cause is that the toolkit deletes experiment history...

CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76396

Splunk AI Toolkit versions below 6.0.0 fail to mark the apply search command as risky, allowing users with the schedule_search capability to trigger deserialization of arbitrary model files via scheduled searches. This can lead to code execution with high confidentiality, integrity, and availabil...

CVE-2026-76396 Improper Access Control through Scheduled Searches in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

CVE-2026-76391 Improper Privilege Management through Agent Run History in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76312 Improper Access Control through Embedded Reports in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language HTML source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerabilit...

CVE-2026-76311

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded report authorization flow. The flow fails to block dispatch archive download requests before the archive is sent to the requester, allowing an unauthenticated user p...

CVE-2026-76312

Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded-report dispatch archive download path. The path fails to enforce the embedded-report authorization boundary and includes sensitive session material in archived searc...

CVE-2026-76311 Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76310 Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76310

An unauthenticated user with an embedded report token can download the search job dispatch archive via REST API, recover session material, and access all data available to the report owner—including admin-level actions—due to embedded report access not blocking dispatch archive downloads. Affecte...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...