InfoSecBulletin Cybersecurity for mankind
Splunk has issued security fixes for 17 weaknesses in different apps and add-ons, such as Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The biggest flaw, listed as CVE-2026-76404, is a serious flaw that allows remote code execution. It has a CVSS score of 9.1. The notice was released on August 19, 2026, and it includes Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
Organizations that use the affected parts need to update them first. This is very important if admin tools, REST APIs, or AI model management features can be seen by untrusted users or networks.
Splunk Patches Security Flaws
Cisco Talos Intelligence
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76389 | High | 8.8 | SSRF may expose tokens. | 1.0.3 |
| CVE-2026-76390 | Medium | 5.3 | OpenAPI spec exposure. | 1.0.3 |
Splunk AI Toolkit
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76391 | High | 8.3 | System-level search access. | 6.0.0 |
| CVE-2026-76392 | Medium | 5.4 | Predictable credentials. | 6.0.0 |
| CVE-2026-76393 | Medium | 5.9 | Model replacement via race condition. | 6.0.0 |
| CVE-2026-76394 | High | 8.3 | Unauthorized container control. | 6.0.0 |
| CVE-2026-76395 | High | 8.8 | Malicious model RCE. | 6.0.0 |
| CVE-2026-76396 | High | 7.5 | Unsafe model deserialization. | 6.0.0 |
| CVE-2026-76397 | High | 8.1 | Experiment data access. | 6.0.0 |
| CVE-2026-76398 | Medium | 4.3 | Unauthorized history deletion. | 6.0.1 |
| CVE-2026-76399 | High | 8.1 | Scheduled search manipulation. | 6.0.1 |
Splunk Connect for Kafka
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76400 | Medium | 5.9 | Event delivery disruption. | 2.2.7 |
| CVE-2026-76401 | Medium | 5.9 | Connector worker DoS. | 2.2.7 |
| CVE-2026-76402 | High | 8.2 | Credential exposure via HEC. | 2.2.7 |
| CVE-2026-76403 | High | 7.4 | Data interception/modification. | 2.2.7 |
MCP Server and VictorOps
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76404 | Critical | 9.1 | OS command execution. | 1.2.1 |
| CVE-2026-76405 | Medium | 4.3 | API key exposure. | 1.0.43 |
Zyxel flaws
Zyxel has put out firmware updates for a serious command injection problem, known as CVE-2026-6837, that affects 18 models of wireless access points. This issue is in the export-cgi part and might let a logged-in admin run operating system commands on the affected devices.
The flaw impacts the PKCS#12 certificate export process. Security expert Mina Nageh Salama said the password for exporting the certificate can be added to a shell command without proper safety checks.
An attacker with a good admin session could use special input to break out of the normal command area and run other commands.
Zyxel said that 18 models of AP are impacted. This includes NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E.
The vendor’s advisory on August 4, 2026, says firmware 7.12 builds are the updated version for these models. For WAX650S, admins need to upgrade to version 7.12(ABRM.0)C0.
Organizations need to quickly find the affected Zyxel APs, install the correct firmware update, and make sure that web management interfaces are not accessible from untrusted networks.
Administrators should change special passwords if they think they might be exposed, restrict management access by using network separation, and check device logs for any strange certificate-export actions.
