InfoSecBulletin Cybersecurity for mankind
Splunk has issued security fixes for 17 weaknesses in different apps and add-ons, such as Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka.
The biggest flaw, listed as CVE-2026-76404, is a serious flaw that allows remote code execution. It has a CVSS score of 9.1. The notice was released on August 19, 2026, and it includes Cisco Talos Intelligence for Enterprise Security Cloud and Splunk On-Call (VictorOps).
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
Organizations that use the affected parts need to update them first. This is very important if admin tools, REST APIs, or AI model management features can be seen by untrusted users or networks.
Splunk Patches Security Flaws
Cisco Talos Intelligence
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76389 | High | 8.8 | SSRF may expose tokens. | 1.0.3 |
| CVE-2026-76390 | Medium | 5.3 | OpenAPI spec exposure. | 1.0.3 |
Splunk AI Toolkit
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76391 | High | 8.3 | System-level search access. | 6.0.0 |
| CVE-2026-76392 | Medium | 5.4 | Predictable credentials. | 6.0.0 |
| CVE-2026-76393 | Medium | 5.9 | Model replacement via race condition. | 6.0.0 |
| CVE-2026-76394 | High | 8.3 | Unauthorized container control. | 6.0.0 |
| CVE-2026-76395 | High | 8.8 | Malicious model RCE. | 6.0.0 |
| CVE-2026-76396 | High | 7.5 | Unsafe model deserialization. | 6.0.0 |
| CVE-2026-76397 | High | 8.1 | Experiment data access. | 6.0.0 |
| CVE-2026-76398 | Medium | 4.3 | Unauthorized history deletion. | 6.0.1 |
| CVE-2026-76399 | High | 8.1 | Scheduled search manipulation. | 6.0.1 |
Splunk Connect for Kafka
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76400 | Medium | 5.9 | Event delivery disruption. | 2.2.7 |
| CVE-2026-76401 | Medium | 5.9 | Connector worker DoS. | 2.2.7 |
| CVE-2026-76402 | High | 8.2 | Credential exposure via HEC. | 2.2.7 |
| CVE-2026-76403 | High | 7.4 | Data interception/modification. | 2.2.7 |
MCP Server and VictorOps
| CVE | Severity | Score | Key Details | Fixed |
|---|---|---|---|---|
| CVE-2026-76404 | Critical | 9.1 | OS command execution. | 1.2.1 |
| CVE-2026-76405 | Medium | 4.3 | API key exposure. | 1.0.43 |
Zyxel flaws
Zyxel has put out firmware updates for a serious command injection problem, known as CVE-2026-6837, that affects 18 models of wireless access points. This issue is in the export-cgi part and might let a logged-in admin run operating system commands on the affected devices.
The flaw impacts the PKCS#12 certificate export process. Security expert Mina Nageh Salama said the password for exporting the certificate can be added to a shell command without proper safety checks.
An attacker with a good admin session could use special input to break out of the normal command area and run other commands.
Zyxel said that 18 models of AP are impacted. This includes NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E.
The vendor’s advisory on August 4, 2026, says firmware 7.12 builds are the updated version for these models. For WAX650S, admins need to upgrade to version 7.12(ABRM.0)C0.
Organizations need to quickly find the affected Zyxel APs, install the correct firmware update, and make sure that web management interfaces are not accessible from untrusted networks.
Administrators should change special passwords if they think they might be exposed, restrict management access by using network separation, and check device logs for any strange certificate-export actions.
