Is CVE-2026-76395 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76395 being exploited in the wild.

How severe is CVE-2026-76395?

High severity, with a CVSS score of 8.8, published 19 August 2026.

Which products and versions are affected?

Splunk AI Toolkit below 6.0.0 (5.7 branch) and below 6.0.1 (6.0 branch).

Is there a fix for CVE-2026-76395?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76395 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76395?

Check whether you run Splunk AI Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76395: Splunk AI Toolkit RCE through unsafe model deserialization

CVE-2026-76395 · Severity: high · CVSS 8.8 · Published 2026-08-19

Splunk AI Toolkit is an add-on that enables machine learning capabilities within Splunk, used to build predictive models and automate analytics. Users with administrative privileges ("power" role) can upload and load model files; a flaw in how the toolkit deserializes model data allows uploading a malicious model file to execute arbitrary code on the Splunk server, compromising data, analytics, and system integrity.

Technologies: Splunk AI Toolkit. Vendors: Splunk.

Quick answers

Is CVE-2026-76395 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76395 being exploited in the wild.
How severe is CVE-2026-76395?: High severity, with a CVSS score of 8.8, published 19 August 2026.
Which products and versions are affected?: Splunk AI Toolkit below 6.0.0 (5.7 branch) and below 6.0.1 (6.0 branch).
Is there a fix for CVE-2026-76395?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76395 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76395?: Check whether you run Splunk AI Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-76395 is a remote code execution vulnerability caused by unsafe deserialization of untrusted data in the model codec of Splunk AI Toolkit. The vulnerability exists in versions below 6.0.0 (for base 5.7) and below 6.0.1 (for base 6.0). The flaw occurs in the model loading REST API endpoint, where sparse matrix data is deserialized without protection against embedded pickle payloads. An attacker with the "power" Splunk role can craft a model file containing malicious pickle content and upload it via the REST API; upon deserialization, the pickle payload executes arbitrary Python code on the Splunk server. The fix is to upgrade to Splunk AI Toolkit 6.0.0 or later (6.0.1 for base 6.0).

Affected products

Splunk AI Toolkit below 6.0.0 (5.7 branch) and below 6.0.1 (6.0 branch)

Timeline

2026-08-19: disclosed
2026-08-19: advisory: SVD-2026-0808

References

https://advisory.splunk.com/advisories/SVD-2026-0808

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.