{"metadata": {"vulnerability": "CVE-2026-76404", "count": 29, "kinds": {"milestone": 6, "sighting": 12, "kev": 0, "other": 11}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-19T00:00:00Z", "date_only": false, "value": "2026-08-19T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisco", "record": "CVE-2026-76404", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-19T00:00:00Z", "date_only": true, "value": "2026-08-19", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1056", "record": "CERTFR-2026-AVI-1056", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-08-19T12:02:03.632Z", "date_only": false, "value": "2026-08-19T12:02:03.632Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-76404", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-19T21:35:17.448Z", "date_only": false, "value": "2026-08-19T21:35:17.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-76404", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-19T21:35:17.448Z", "date_only": false, "value": "2026-08-19T21:35:17.448Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "CVE-2026-76404", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-19T22:17:27Z", "date_only": false, "value": "2026-08-19T22:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3V49-2FCM-3RCJ", "record": "GHSA-3V49-2FCM-3RCJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-08-19T22:17:27.170Z", "date_only": false, "value": "2026-08-19T22:17:27.170", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76404", "record": "FKIE_CVE-2026-76404", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-19T23:00:43.175Z", "date_only": false, "value": "2026-08-19T23:00:43.175545Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthtjphemr2m", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "861252e0-82cf-47d2-9002-a4a56696cd5d", "content": "\ud83d\udd34 CVE-2026-76404 - Critical (9.1)\n\nIn Splunk MCP Server app versions below 1.2.1, a user who holds the \"admin\" Splunk role could exe...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-76404/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthtjphemr2m"}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1056", "record": "CERTFR-2026-AVI-1056", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1056", "record": "CERTFR-2026-AVI-1056", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1056", "record": "CERTFR-2026-AVI-1056", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-08-20T00:10:04.354Z", "date_only": false, "value": "2026-08-20T00:10:04.354266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthxfqi6lq2t", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "12e03d0f-171f-4b53-91b1-5a230c60576c", "content": "\ud83d\udea8 CVE-2026-76404 \u2014 CVSS 9.1 CRITICAL\n\nIn Splunk MCP Server app versions below 1.2.1, a user who holds the \"admin\" Splunk role could execute arbit...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76404\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mthxfqi6lq2t"}, {"timestamp": "2026-08-20T00:35:07Z", "date_only": false, "value": "2026-08-20T00:35:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3V49-2FCM-3RCJ", "record": "GHSA-3V49-2FCM-3RCJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-20T00:35:07Z", "date_only": false, "value": "2026-08-20T00:35:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3V49-2FCM-3RCJ", "record": "GHSA-3V49-2FCM-3RCJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-20T03:00:06.501Z", "date_only": false, "value": "2026-08-20T03:00:06.501443Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtiavsq55r2y", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "b78289b1-cf69-454a-ac39-0157842c7675", "content": "CVE-2026-76404 - splunk mcp server app\nThe Splunk MCP Server app, used for managing credentials, has a security flaw that could allow an administrator to execute unauthorized commands on the server. This is a concern\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#splunk #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mtiavsq55r2y"}, {"timestamp": "2026-08-20T03:00:26.755Z", "date_only": false, "value": "2026-08-20T03:00:26.755010Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117125600108651443", "record": "cve-2026-76404", "field": "creation_timestamp", "uuid": "4fd1aa7b-c36d-495a-887d-11152f20c03d", "content": "Splunk MCP Server app v1.2 is impacted by CVE-2026-76404 (CRITICAL, CVSS 9.1) \u2014 insecure deserialization lets admin users run arbitrary OS commands. Limit admin access & monitor for misuse until a patch is released. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-sufficiently-verifying-that-the-a0d42d963a9e6a80 #OffSeq #Splunk #Infosec #CVE202676404", "url": "https://infosec.exchange/users/offseq/statuses/117125600108651443"}, {"timestamp": "2026-08-20T03:00:29.148Z", "date_only": false, "value": "2026-08-20T03:00:29.148002Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtiawh7eli2n", "record": "cve-2026-76404", "field": "creation_timestamp", "uuid": "47fdfaf8-869a-45fe-9290-5b782695cd6e", "content": "CVE-2026-76404: Splunk MCP Server v1.2 (CRITICAL) enables admin users to run arbitrary OS commands due to unsafe deserialization. Restrict admin roles & monitor activity. Patch status unknown. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-suffi...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mtiawh7eli2n"}, {"timestamp": "2026-08-20T05:03:07.628Z", "date_only": false, "value": "2026-08-20T05:03:07.628419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtihrrs56e24", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "b24363eb-bb3c-4a7c-b737-0654b5e6d2eb", "content": "Daily IT Security Digest \u2014 2026-08-20\nCVE-2026-76404 (CRITICAL, CVSS 9.1)\n\nA critical vulnerability in Splunk's Model Context Protocol server app allows insecure deserialization that lets admin users run arbitrary OS commands. While limited to admin users, any compromise of admin credentials could", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3mtihrrs56e24"}, {"timestamp": "2026-08-20T05:31:48.056Z", "date_only": false, "value": "2026-08-20T05:31:48.056825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtijf2aax32b", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "4011b141-ec13-4a5e-98b5-28f1bf6ca4b0", "content": "Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons.\n\n#Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mtijf2aax32b"}, {"timestamp": "2026-08-20T14:58:09.767Z", "date_only": false, "value": "2026-08-20T14:58:09.767408Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mtjizs5v6j2h", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "6312b6c0-94f8-4a46-9843-f3e04e56bdee", "content": "CVE-2026-76404 is trending. Hype score 4, currently #10 on cvemon.\n\nIn Splunk MCP Server app versions below 1.2.1, a user who holds the \"admin\" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-76404", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mtjizs5v6j2h"}, {"timestamp": "2026-08-20T15:09:45.301Z", "date_only": false, "value": "2026-08-20T15:09:45.301346Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76404", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-20T15:09:45.301Z", "date_only": false, "value": "2026-08-20T15:09:45.301346Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76404", "record": "FKIE_CVE-2026-76404", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-08-20T15:26:31.137Z", "date_only": false, "value": "2026-08-20T15:26:31.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-76404", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-20T15:26:31.137Z", "date_only": false, "value": "2026-08-20T15:26:31.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76404", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-21T01:03:28.092Z", "date_only": false, "value": "2026-08-21T01:03:28.092029Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mtkku5t4y727", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "93964811-bbf9-4c8a-891b-57648ea14162", "content": "Splunk\u306eMCP Server\u30a2\u30d7\u30ea\u306b\u6df1\u523b\u306a\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\uff08CVE-2026-76404\u3001CVSS 9.1\uff09\u304c\u767a\u899a\n\nCVE-2026-76404: Critical Remote Code Execution Hits Splunk MCP Server App (CVSS 9.1)\u3000#DailyCyberSecurity (Aug 20)\n\nsecurityonline.info/splunk-apps-...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mtkku5t4y727"}, {"timestamp": "2026-08-21T02:47:38.506Z", "date_only": false, "value": "2026-08-21T02:47:38.506939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtkqogn7uj2v", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "8008f038-fdd9-47ca-baf5-e1e372cc059a", "content": "Top 3 CVE for last 7 days:\nCVE-2026-65400: 28 interactions\nCVE-2026-59310: 25 interactions\nCVE-2026-43499: 14 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-19490: 8 interactions\nCVE-2026-76404: 8 interactions\nCVE-2026-63030: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mtkqogn7uj2v"}, {"timestamp": "2026-08-22T07:09:51.721Z", "date_only": false, "value": "2026-08-22T07:09:51.721433Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mtnps7cets2f", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "b5baa024-0517-4162-958d-5182a5f4e377", "content": "Critical CVE-2026-76404 patched: Splunk MCP Server RCE + 16 flaws fixed \u2014 update now, especially AI Toolkit and Kafka apps. #Splunk #Cybersecurity #RCE #AIsecurity #Vulnerabilities https://thedailytechfeed.com/splunk-urgent-patch-released-critical-rce-in-mcp-server-16-other-flaws/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mtnps7cets2f"}, {"timestamp": "2026-08-25T17:37:07.181Z", "date_only": false, "value": "2026-08-25T17:37:07.181947Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtweamb35w2b", "record": "CVE-2026-76404", "field": "creation_timestamp", "uuid": "989e8964-4fc3-4a9b-aba4-cf048f9602be", "content": "\ud83d\udccc CVE-2026-76404 - In Splunk MCP Server app versions below 1.2.1, a user who holds the \"admin\" Splunk role could execute arbitrary commands on the underlying operating s... https://www.cyberhub.blog/cves/CVE-2026-76404", "url": "https://bsky.app/profile/cyberhub.blog/post/3mtweamb35w2b"}, {"timestamp": "2026-10-24T13:10:00.147Z", "date_only": false, "value": "2026-10-24T13:10:00.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76404", "record": "FKIE_CVE-2026-76404", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T02:53:09.053Z", "anchors": {"origin": {"timestamp": "2026-08-19T00:00:00Z", "date_only": false, "value": "2026-08-19T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisco", "record": "CVE-2026-76404", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-19T00:00:00Z", "date_only": false, "value": "2026-08-19T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisco", "record": "CVE-2026-76404", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 7267989.053155, "hours": 2018.8858480986112, "days": 84.12024367077547, "min_seconds": 7181589.053155, "max_seconds": 7267989.053155, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-19T00:00:00Z", "date_only": false, "value": "2026-08-19T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisco", "record": "CVE-2026-76404", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T02:53:09.053Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}