Splunk Patches Critical MCP Server RCE and 16 Other Security Flaws Across AI Toolkit, Kafka Apps

Cybersecuritynews •Abinaya • August 20, 2026

Splunk has released security updates for 17 vulnerabilities affecting several apps and add-ons, including Splunk MCP Server, Splunk AI Toolkit, and Splunk Connect for Kafka. The most severe issue, tracked as CVE-2026-76404, is a critical remote code execution vulnerability with a CVSS score of 9.1. The advisory, published on August 19, 2026, also covers Cisco […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability Discovered in Splunk MCP Server CVE-2026-76404, a critical remote code execution vulnerability in Splunk MCP Server, was disclosed on August 19, 2026, with a CVSS score of 9.1. This vulnerability allows users with admin roles to execute arbitrary commands on the underlying operating system due to insecure deserialization in the credential management component. The MCP Server is widely used in enterprise environments, with over 20,468 downloads, making it integral to security operations. The vulnerability's exploitation risk is heightened as SOC analysts often hold admin roles, lowering theoretical barriers to exploitation. Splunk has released security updates addressing this and 16 other vulnerabilities across its applications. Despite the severity rating, public discourse on the issue remains minimal, indicating a potential gap in awareness and urgency among users. 3 sources 70

Extracted Entities

Splunk Patches Critical MCP Server RCE and 16 Other Security Flaws Across AI Toolkit, Kafka Apps

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (4)