CVE-2026-76395 — CVSS 8.8 HIGH Severity | NVD Vulnerability Record

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation. CVSS Score: 8.8 CWE: CWE-502 Affected: Splunk Ai Toolkit

Decision: Validate relevance and exposure using the cited source and internal evidence before treating this record as an incident, confirmed compromise, or customer-specific finding.

Vulnerability class: Command Injection. Assessment: Active exploitation is not confirmed by the available evidence. This vulnerability is exploitable over the network, requiring low-privileged access and no user interaction. Prioritization must combine technical severity, exposure, asset criticality, and compensating controls.

This extract is escaped and rendered from the ingested source record; generated analysis is not presented as a source fact.

The source identifies command/code execution and a remotely reachable service context.

title: Web Service Spawning a Command Interpreter Related to CVE-2026-76395
id: dd3be0d4-bd74-5ed1-a183-1eb28afe7c4a
status: experimental
description: Detects command interpreters spawned by common web-service processes. Requires product-specific parent-process
  tuning.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-76395
author: CYBERDUDEBIVASH Sentinel APEX Detection Engineering
date: '2026-08-21'
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - /httpd
    - /nginx
    - /java
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - /bin/sh
    - /bin/bash
  condition: selection_parent and selection_child
falsepositives:
- Documented administrative hooks
- Approved application maintenance
level: high
tags:
- attack.execution
- attack.t1059

// Web Service Spawning a Command Interpreter Related to CVE-2026-76395
// report: CDB-CTI-2026-A6E179629CF6
// DeviceProcessEvents is a real Microsoft Defender/Sentinel Advanced Hunting table; tune the parent-service and interpreter name lists to the affected product's actual executable before deployment.
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("w3wp.exe", "httpd", "nginx", "java")
| where FileName has_any ("cmd.exe", "powershell.exe", "sh", "bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine