CVE-2026-76398
Medium · CVSS 4.3Published 2026-08-19
CVSS
4.3
Medium
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-76398?
In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.
CVSS Score Explained
CVSS 4.3 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-76923Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service5.5
- CVE-2026-76924Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service5.5
- CVE-2026-76926BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service3.1
- CVE-2026-76927H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service4.7
- CVE-2026-76928X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service7.5
- CVE-2026-76929Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service4.7