IT adminsNetwork & security appliances

Splunk AI Toolkit: SSRF and Deserialization Flaws

Q: Does Splunk AI Toolkit 6.0.0 address every listed Splunk AI Toolkit issue?

The entries affecting versions >= 5.7 and = 6.0 and < 6.0.1. Use 6.0.1 and later as the update destination covering all the listed Splunk AI Toolkit entries.

Q: Does this advisory establish that every flaw can be exploited remotely without signing in?

No. The available details identify affected products, version ranges, and weakness types, but do not specify authentication requirements or other attack preconditions. SSRF and insecure deserialization describe categories of weakness, not a complete attack scenario.

Q: Can I use a CVSS score to prioritize these updates?

No CVSS scores are available for these entries. Start by identifying affected installations and consulting the vendor's advisory for product-specific update guidance. A severity score should not be inferred from a CVE identifier or weakness name.

Published October 30, 2026 · Splunk · 10 CVEs · NVD and CISA KEV checked October 30, 2026

Illustration of rack-mounted network gear with cables

In short Splunk lists security fixes across AI Toolkit and related apps, with different affected versions and update targets to check.

What happened

Splunk's advisory covers Splunk AI Toolkit, Cisco Talos Intelligence for Enterprise Security Cloud, Splunk Connect for Kafka, and Splunk MCP Server app. Think of these products as different doors in an office: repairing a problem with one door does not establish that the others have been repaired. Each installed product needs its own version check against the advisory.

The advisory identifies server-side request forgery (SSRF) and insecure deserialization among the vulnerability types across these products. It covers CVE-2026-76389, CVE-2026-76391, CVE-2026-76394, CVE-2026-76395, CVE-2026-76396, CVE-2026-76397, CVE-2026-76399, CVE-2026-76402, CVE-2026-76403, and CVE-2026-76404. The available details do not assign a specific weakness type to each CVE.

The vendor's affected-version table provides the concrete update targets. No accompanying NVD descriptions or severity scores are available here to explain the individual flaws further. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-29.

Technical details

Server-side request forgery, or SSRF, means a server can be induced to make a request that it should not make. The important distinction is whose request it becomes: an application server makes the connection, rather than the person interacting with it. The advisory identifies SSRF as a weakness type, but the available details do not specify the vulnerable request handler, permitted destinations, or access an attacker would need.

Insecure deserialization concerns how software reconstructs structured data into objects or other application structures. The weakness arises when that reconstruction handles untrusted data unsafely. The advisory does not establish which data format, library, or processing step is involved in these products. It also does not provide enough detail to describe a specific exploit or conclude that any individual CVE permits code execution.

The version boundaries are especially important for Splunk AI Toolkit. Versions >= 5.7 and < 6.0.0 are affected by CVE-2026-76391, CVE-2026-76394, CVE-2026-76395, CVE-2026-76396, and CVE-2026-76397, with fixes in 6.0.0 and later. A separate entry identifies versions >= 6.0 and < 6.0.1 as affected by CVE-2026-76399, fixed in 6.0.1 and later. Treating 6.0.0 as the final update destination would therefore miss that separate entry.

No Common Weakness Enumeration (CWE) identifiers or Common Vulnerability Scoring System (CVSS) scores are supplied for these entries. CVSS is a framework for describing vulnerability severity; without a reported score and its supporting details, a numerical severity comparison is unavailable. The underlying implementation mistakes, authentication requirements, and other attack preconditions are also unspecified.

Weakness types: Server-side request forgery (SSRF), Insecure deserialization

Who is affected

Everyday users

For everyday users, the practical question is whether an organization you rely on operates an affected Splunk product. These are product-specific updates, so knowing that an organization uses Splunk does not establish that it has an affected installation. The advisory does not describe a browser, personal-device, or account-level change for users to make.

If you use services supported by these products, the useful next step is to ask the responsible IT team whether it has checked the installed product versions. The available details do not establish a particular effect on personal information, account access, or service availability.

Developers

Developers maintaining integrations with Splunk AI Toolkit, Splunk Connect for Kafka, or Splunk MCP Server app should identify which product versions their environments actually use. An application dependency or deployment record is useful only if it matches what is running. The advisory's separate version ranges mean that a broad statement such as 'the Splunk environment was updated' is insufficient to establish coverage.

The weakness names explain the general areas of concern, but they do not reveal a specific unsafe endpoint or serialization routine to change in your own code. Follow the update steps in the vendor's advisory, then check the workflows that depend on the updated product. Avoid assuming that a custom code change substitutes for the listed vendor fix.

Server and IT admins

Server and IT admins should match every installed product to its advisory entry. Cisco Talos Intelligence for Enterprise Security Cloud versions >= 1.0 and < 1.0.3 are affected by CVE-2026-76389; the fix is 1.0.3 and later. Splunk Connect for Kafka versions >= 2.2 and < 2.2.7 are affected by CVE-2026-76402 and CVE-2026-76403; the fix is 2.2.7 and later.

Splunk MCP Server app versions >= 1.2 and < 1.2.1 are affected by CVE-2026-76404; the fix is 1.2.1 and later. For Splunk AI Toolkit, account for both affected-version ranges and use 6.0.1 and later as the update destination covering the listed entries. These CVEs were not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of the catalog check; that catalog status does not establish whether exploitation has occurred.

What to do now

Inventory installations of Cisco Talos Intelligence for Enterprise Security Cloud, Splunk AI Toolkit, Splunk Connect for Kafka, and Splunk MCP Server app. Record the installed version of each product separately.
For Cisco Talos Intelligence for Enterprise Security Cloud versions >= 1.0 and < 1.0.3, follow the update steps in the vendor's advisory to install 1.0.3 and later.
For Splunk AI Toolkit, check both ranges: >= 5.7 and < 6.0.0, and >= 6.0 and < 6.0.1. Follow the update steps in the vendor's advisory to reach 6.0.1 and later, accounting for CVE-2026-76399 as well as the earlier entries.
For Splunk Connect for Kafka versions >= 2.2 and < 2.2.7, follow the update steps in the vendor's advisory to install 2.2.7 and later.
For Splunk MCP Server app versions >= 1.2 and < 1.2.1, follow the update steps in the vendor's advisory to install 1.2.1 and later.
After updating, confirm each installed product's version and exercise the workflows that use it. Record any installation that still falls within an affected range so it remains visible for follow-up.

Check the Splunk version · official docs

$SPLUNK_HOME/bin/splunk version

If you can't update yet

If an update must wait, check the vendor advisory for guidance on restricting access to the affected product or reducing its internet exposure. Treat access restrictions as temporary risk reduction, without assuming they resolve the vulnerability.
Check the vendor advisory before disabling an affected feature, and do so only if the vendor recommends it for the relevant product.

How to confirm the fix

Confirm the installed version of every affected product after the update. The Splunk version command can identify the Splunk version, but its output alone does not establish the installed versions of all the separately named products.
Match the results to the listed fixes: Cisco Talos Intelligence for Enterprise Security Cloud at 1.0.3 and later, Splunk AI Toolkit at 6.0.1 and later, Splunk Connect for Kafka at 2.2.7 and later, and Splunk MCP Server app at 1.2.1 and later.
Check that the updated products still support the workflows your environment depends on. Successful operation is a useful functional check; the installed version establishes whether the listed update target was reached.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

This advisory covers 10 CVEs, so check individual scores in the vendor advisory and on NVD.

Affected products and fixed versions 10 rows

Product	Affected versions	Fixed version / action	CVE
Cisco Talos Intelligence for Enterprise Security Cloud	>= 1.0 and < 1.0.3	1.0.3 and later	CVE-2026-76389
Splunk AI Toolkit	>= 5.7 and < 6.0.0	6.0.0 and later	CVE-2026-76391
Splunk AI Toolkit	>= 5.7 and < 6.0.0	6.0.0 and later	CVE-2026-76394
Splunk AI Toolkit	>= 5.7 and < 6.0.0	6.0.0 and later	CVE-2026-76395
Splunk AI Toolkit	>= 5.7 and < 6.0.0	6.0.0 and later	CVE-2026-76396
Splunk AI Toolkit	>= 5.7 and < 6.0.0	6.0.0 and later	CVE-2026-76397
Splunk AI Toolkit	>= 6.0 and < 6.0.1	6.0.1 and later	CVE-2026-76399
Splunk Connect for Kafka	>= 2.2 and < 2.2.7	2.2.7 and later	CVE-2026-76402
Splunk Connect for Kafka	>= 2.2 and < 2.2.7	2.2.7 and later	CVE-2026-76403
Splunk MCP Server app	>= 1.2 and < 1.2.1	1.2.1 and later	CVE-2026-76404

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

Does Splunk AI Toolkit 6.0.0 address every listed Splunk AI Toolkit issue?

The entries affecting versions >= 5.7 and < 6.0.0 list 6.0.0 and later as fixed. However, CVE-2026-76399 affects versions >= 6.0 and < 6.0.1. Use 6.0.1 and later as the update destination covering all the listed Splunk AI Toolkit entries.

Does this advisory establish that every flaw can be exploited remotely without signing in?