InfoSecBulletin Cybersecurity for mankind
Splunk has issued security fixes for 17 weaknesses in different apps and add-ons, such as Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The biggest flaw, listed as CVE-2026-76404, is a serious flaw that allows remote code execution. It has a CVSS score of 9.1. The notice was released on August 19, 2026, and it includes Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Organizations that use the affected parts need to update them first. This is very important if admin tools, REST APIs, or AI model management features can be seen by untrusted users or networks.
Splunk Patches Security Flaws
Cisco Talos Intelligence
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76389 | High | 8.8 | SSRF may expose tokens. | 1.0.3 |
| CVE-2026-76390 | Medium | 5.3 | OpenAPI spec exposure. | 1.0.3 |
Splunk AI Toolkit
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76391 | High | 8.3 | System-level search access. | 6.0.0 |
| CVE-2026-76392 | Medium | 5.4 | Predictable credentials. | 6.0.0 |
| CVE-2026-76393 | Medium | 5.9 | Model replacement via race condition. | 6.0.0 |
| CVE-2026-76394 | High | 8.3 | Unauthorized container control. | 6.0.0 |
| CVE-2026-76395 | High | 8.8 | Malicious model RCE. | 6.0.0 |
| CVE-2026-76396 | High | 7.5 | Unsafe model deserialization. | 6.0.0 |
| CVE-2026-76397 | High | 8.1 | Experiment data access. | 6.0.0 |
| CVE-2026-76398 | Medium | 4.3 | Unauthorized history deletion. | 6.0.1 |
| CVE-2026-76399 | High | 8.1 | Scheduled search manipulation. | 6.0.1 |
Splunk Connect for Kafka
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76400 | Medium | 5.9 | Event delivery disruption. | 2.2.7 |
| CVE-2026-76401 | Medium | 5.9 | Connector worker DoS. | 2.2.7 |
| CVE-2026-76402 | High | 8.2 | Credential exposure via HEC. | 2.2.7 |
| CVE-2026-76403 | High | 7.4 | Data interception/modification. | 2.2.7 |
MCP Server and VictorOps
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76404 | Critical | 9.1 | OS command execution. | 1.2.1 |
| CVE-2026-76405 | Medium | 4.3 | API key exposure. | 1.0.43 |
Zyxel flaws
Zyxel has put out firmware updates for a serious command injection problem, known as CVE-2026-6837, that affects 18 models of wireless access points. This issue is in the export-cgi part and might let a logged-in admin run operating system commands on the affected devices.
The flaw impacts the PKCS#12 certificate export process. Security expert Mina Nageh Salama said the password for exporting the certificate can be added to a shell command without proper safety checks.
An attacker with a good admin session could use special input to break out of the normal command area and run other commands.
Zyxel said that 18 models of AP are impacted. This includes NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E.
The vendor’s advisory on August 4, 2026, says firmware 7.12 builds are the updated version for these models. For WAX650S, admins need to upgrade to version 7.12(ABRM.0)C0.
Organizations need to quickly find the affected Zyxel APs, install the correct firmware update, and make sure that web management interfaces are not accessible from untrusted networks.
Administrators should change special passwords if they think they might be exposed, restrict management access by using network separation, and check device logs for any strange certificate-export actions.
