InfoSecBulletin Cybersecurity for mankind
Splunk has issued security fixes for 17 weaknesses in different apps and add-ons, such as Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The biggest flaw, listed as CVE-2026-76404, is a serious flaw that allows remote code execution. It has a CVSS score of 9.1. The notice was released on August 19, 2026, and it includes Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Organizations that use the affected parts need to update them first. This is very important if admin tools, REST APIs, or AI model management features can be seen by untrusted users or networks.
Splunk Patches Security Flaws
Cisco Talos Intelligence
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76389 | High | 8.8 | SSRF may expose tokens. | 1.0.3 |
| CVE-2026-76390 | Medium | 5.3 | OpenAPI spec exposure. | 1.0.3 |
Splunk AI Toolkit
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76391 | High | 8.3 | System-level search access. | 6.0.0 |
| CVE-2026-76392 | Medium | 5.4 | Predictable credentials. | 6.0.0 |
| CVE-2026-76393 | Medium | 5.9 | Model replacement via race condition. | 6.0.0 |
| CVE-2026-76394 | High | 8.3 | Unauthorized container control. | 6.0.0 |
| CVE-2026-76395 | High | 8.8 | Malicious model RCE. | 6.0.0 |
| CVE-2026-76396 | High | 7.5 | Unsafe model deserialization. | 6.0.0 |
| CVE-2026-76397 | High | 8.1 | Experiment data access. | 6.0.0 |
| CVE-2026-76398 | Medium | 4.3 | Unauthorized history deletion. | 6.0.1 |
| CVE-2026-76399 | High | 8.1 | Scheduled search manipulation. | 6.0.1 |
Splunk Connect for Kafka
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76400 | Medium | 5.9 | Event delivery disruption. | 2.2.7 |
| CVE-2026-76401 | Medium | 5.9 | Connector worker DoS. | 2.2.7 |
| CVE-2026-76402 | High | 8.2 | Credential exposure via HEC. | 2.2.7 |
| CVE-2026-76403 | High | 7.4 | Data interception/modification. | 2.2.7 |
MCP Server and VictorOps
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76404 | Critical | 9.1 | OS command execution. | 1.2.1 |
| CVE-2026-76405 | Medium | 4.3 | API key exposure. | 1.0.43 |
Zyxel flaws
Zyxel has put out firmware updates for a serious command injection problem, known as CVE-2026-6837, that affects 18 models of wireless access points. This issue is in the export-cgi part and might let a logged-in admin run operating system commands on the affected devices.
The flaw impacts the PKCS#12 certificate export process. Security expert Mina Nageh Salama said the password for exporting the certificate can be added to a shell command without proper safety checks.
An attacker with a good admin session could use special input to break out of the normal command area and run other commands.
Zyxel said that 18 models of AP are impacted. This includes NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E.
The vendor’s advisory on August 4, 2026, says firmware 7.12 builds are the updated version for these models. For WAX650S, admins need to upgrade to version 7.12(ABRM.0)C0.
Organizations need to quickly find the affected Zyxel APs, install the correct firmware update, and make sure that web management interfaces are not accessible from untrusted networks.
Administrators should change special passwords if they think they might be exposed, restrict management access by using network separation, and check device logs for any strange certificate-export actions.
