EUVD-2026-62964

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

EUVD-2026-62962

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

EUVD-2026-62960

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit...

CVE-2026-76399

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-76397

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76395

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit...

CVE-2026-76333

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

CVE-2026-76324

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...

CVE-2026-76399

Splunk AI Toolkit versions below 6.0.1 are affected by an incorrect permission assignment vulnerability. A user holding the "power" Splunk role can modify app-provided scheduled searches to execute arbitrary Search Processing Language (SPL) queries using the permissions of the search owner. This ...

CVE-2026-76399 Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-76397

Splunk AI Toolkit versions below 6.0.0 are affected: a user with the "power" Splunk role can access and delete all experiment history data, including other users' data, because the tool does not preserve the trusted experiment scope when processing caller-controlled query values. CVSS 8.1 (HIGH) ...

CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76395 Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit...

CVE-2026-76333

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient URL validation in Dashboard Studio workflow actions. A user holding the "power" role can store a crafted URL in a workflow ac...

CVE-2026-76324

CVE-2026-76324 is a stored Cross-Site Scripting (XSS) vulnerability in Splunk Web Tours affecting Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient output encoding when Splunk Web renders tour content and navigation links, allowing a tour selecto...

CVE-2026-76325

CVE-2026-76325 is a Stored Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the "power" role can store a malicious ui-tour knowledge object matching an auto-tour page name and share it at the app level. The root cause...

PT-2026-78824

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description A user with the "power" Splunk role can access and delete experiment history data belonging to other users. This occurs because the application fails to preserve the trusted experiment scop...

PT-2026-78822

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description A user with the "power" Splunk role can execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. This occurs because a model codec...

PT-2026-78755

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Splunk Web fails to sufficiently validate dashboard content...

PT-2026-78768

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store malicious Search...