Critical Alert 1 Active Exploit Detected Today

CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability →
Powered by CVE Watchtower
×
August 20, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-76404NVD

Vulnerability Summary

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
Severity Level
CRITICAL(9.1)
Published Date
Aug 19, 2026
Last Modified
Aug 19, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredHigh
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh