CVE-2026-76404: Splunk MCP Server Privilege-to-Command Execution Flaw (CVSS 9.1) — Detection and Remediation Guide

---
title: Splunk Process Spawning Suspicious Shell or System Binary
id: 3f8c1a72-7640-4b04-a9c5-2026c476404a
status: experimental
description: Detects Splunk daemon or MCP Server Python process spawning shells, downloaders, or reconnaissance tools consistent with post-exploitation of CVE-2026-76404 (arbitrary command execution via MCP Server credential management deserialization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76404
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\splunkd.exe'
      - '\python.exe'
      - '\python3.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
  filter_known_good:
    CommandLine|contains:
      - 'splunk'
  condition: selection_parent and selection_child and not filter_known_good
falsepositives:
  - Custom Splunk apps or scripted inputs that legitimately invoke system commands — baseline per deployment
level: high
---
title: Linux Splunk Process Spawning Shell or Reconnaissance Commands
id: 8e2d5b14-7640-4c91-b7a3-2026c476404b
status: experimental
description: Detects splunkd or MCP Server Python processes on Linux spawning interactive shells or common post-exploitation tools, consistent with exploitation of CVE-2026-76404.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76404
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/splunkd'
      - '/python'
      - '/python3'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python3'
      - '/perl'
      - '/whoami'
      - '/id'
      - '/uname'
  condition: selection_parent and selection_child
falsepositives:
  - Splunk scripted inputs and modular inputs that legitimately shell out — tune against your installed app inventory
level: high
---
title: MCP Server App Credential Store Modification by Non-Splunk Process
id: c41a9e67-7640-4d28-9f1b-2026c476404c
status: experimental
description: Detects write access to Splunk MCP Server app credential storage locations by processes other than splunkd, indicating potential tampering with serialized credential data exploited in CVE-2026-76404.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76404
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Splunk\etc\apps\mcp'
      - '\Splunk\var\lib\splunk\'
  filter_legit:
    Image|endswith:
      - '\splunkd.exe'
      - '\splunk.exe'
      - '\python.exe'
  condition: selection and not filter_legit
falsepositives:
  - Administrators editing app configuration during deployment windows
level: medium

let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","net.exe","whoami.exe","nltest.exe","bash","sh","curl","wget","nc","ncat","perl"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any ("splunkd","splunk","python","python3")
    | where FileName has_any (suspiciousChildren)
    | where not(ProcessCommandLine has "splunk")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
    | extend Source = "Defender"),
    (Syslog
    | where TimeGenerated > ago(7d)
    | where ProcessName has_any (suspiciousChildren)
    | where SyslogMessage has "splunkd" or SyslogMessage has "mcp"
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
    | extend Source = "Syslog")
| order by TimeGenerated desc

-- Hunt for Splunk/MCP Server processes spawning suspicious child processes
-- Relevant to CVE-2026-76404 post-exploitation detection
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(item=pslist(pid=Ppid), field='Name') AS ParentName
FROM pslist()
WHERE (CommandLine =~ '(cmd|powershell|pwsh|certutil|bitsadmin|mshta|rundll32|bash|curl|wget|nc |ncat|/bin/sh)'
   OR Name =~ '(?i)cmd.exe|powershell.exe|bash|sh$|nc$')
  AND get_member(item=pslist(pid=Ppid), field='Name') =~ '(?i)splunkd|splunk|python'

#!/bin/bash
# CVE-2026-76404 - Splunk MCP Server app verification and hardening check
# Run on Splunk hosts (search heads / heavy forwarders running the MCP Server app)

set -e
SPLUNK_HOME="${SPLUNK_HOME:-/opt/splunk}"
APP_DIR="$SPLUNK_HOME/etc/apps"

echo "[*] CVE-2026-76404 verification - $(hostname) - $(date)"

# 1. Locate MCP Server app installations
echo "[*] Searching for MCP Server app installations..."
FOUND=0
for dir in "$APP_DIR"/*/; do
    CONF="${dir}default/app.conf"
    [ -f "$CONF" ] || CONF="${dir}local/app.conf"
    [ -f "$CONF" ] || continue
    if grep -qi "mcp" "$CONF" 2>/dev/null || [[ "$(basename $dir)" == *"mcp"* ]]; then
        FOUND=1
        VERSION=$(grep -E "^version" "$CONF" | head -1 | awk -F'=' '{print $2}' | tr -d ' ')
        echo "    App dir : $dir"
        echo "    Version : ${VERSION:-unknown}"
        if [[ -n "$VERSION" ]]; then
            MAJOR=$(echo "$VERSION" | cut -d. -f1)
            MINOR=$(echo "$VERSION" | cut -d. -f2)
            PATCH=$(echo "$VERSION" | cut -d. -f3)
            if [ "$MAJOR" -lt 1 ] || { [ "$MAJOR" -eq 1 ] && [ "$MINOR" -lt 2 ]; } || { [ "$MAJOR" -eq 1 ] && [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 1 ]; }; then
                echo "    [!!] VULNERABLE - below 1.2.1. Upgrade immediately."
            else
                echo "    [OK] Version is 1.2.1 or later."
            fi
        else
            echo "    [??] Could not parse version - verify manually in Splunk Web (Apps > Manage Apps)."
        fi
    fi
done
[ "$FOUND" -eq 0 ] && echo "[+] No MCP Server app detected in $APP_DIR"

# 2. Enumerate users holding the admin role (attack surface review)
echo "[*] Listing users with admin role (review for least privilege)..."
PASSWD_CONF="$SPLUNK_HOME/etc/passwd"
if [ -f "$PASSWD_CONF" ]; then
    grep -B2 ":admin" "$PASSWD_CONF" | grep "^\[" | tr -d '[]' || echo "    (check via: splunk btool authorize list or REST /services/authentication/users)"
fi

# 3. Check for suspicious recent child processes of splunkd (post-exploitation canary)
echo "[*] Checking for suspicious splunkd child processes..."
ps -eo pid,ppid,comm,args | awk 'NR>1 {print}' | grep -E "(cmd|bash|sh |curl|wget|nc |ncat|perl)" | while read -r line; do
    PPID=$(echo "$line" | awk '{print $2}')
    PNAME=$(ps -p "$PPID" -o comm= 2>/dev/null || true)
    if [[ "$PNAME" == *"splunk"* || "$PNAME" == *"python"* ]]; then
        echo "    [!!] Suspicious: $line (parent: $PNAME)"
    fi
done

echo "[*] Done. If vulnerable, upgrade MCP Server app to >= 1.2.1 and restart Splunk."