Cisco vulnerabilities, week 34 of 2026: critical Splunk, Crosswork and Secure Workload fixes lead 125 CVEs

The release at a glance

Cisco's week 34 of 2026 covers 125 CVEs across Splunk and Cisco products. The release contains 12 critical, 42 high, 66 medium and 5 low severity findings. No CVE in this set is listed in CISA KEV or known to be exploited. Splunk Enterprise accounts for 60 of the 125 CVEs, followed by Splunk SOAR with 15. The most urgent items sit in Cisco Crosswork Planning, Cisco Secure Workload, Splunk Enterprise and the Splunk MCP Server app, where several network-reachable critical flaws allow unauthenticated action or affect system integrity.

What matters most

These are the issues to review first; the entries below are covered by separate advisory pages on this site.

Cisco Crosswork Planning: CVE-2026-20030 is SQL injection (CWE-89) and CVE-2026-20357 is missing authentication for a critical function (CWE-306); both are rated CVSS 10, network-accessible and require no privileges. Cisco states that PSIRT is not aware of public announcements or malicious use.

Cisco Secure Workload: CVE-2026-20315 is improper access control (CWE-284) and CVE-2026-20317 is improper authentication (CWE-287); both are rated CVSS 10, network-accessible and require no privileges, with scope change. Cisco states the same: no known public announcements or malicious use.

Splunk Enterprise: CVE-2026-76310, CVE-2026-76311 and CVE-2026-76312 are improper access control flaws in embedded reports. An unauthenticated user with an embedded report token can download dispatch archives or recover session material, then access report-owner data and affect system integrity; where the owner holds the admin role, administrative actions are possible. Each is rated CVSS 9.4, network-accessible and requires no user interaction.

Splunk MCP Server app: CVE-2026-76404 is remote code execution through deserialisation of untrusted data (CWE-502) for a user who already holds the admin role; it is rated CVSS 9.1 and fixed in version 1.2.1.

Patch in this order

1. Cisco Crosswork Planning: apply the August 2026 hardening release first. CVE-2026-20030, CVE-2026-20357, CVE-2026-20358 and CVE-2026-20359 are internally found issues in the same advisory; the first two are pre-authentication and network-accessible. The available advisory does not list a fixed version for Crosswork Planning, so confirm the patched release with Cisco.
2. Cisco Secure Workload: apply the August 2026 hardening release next. CVE-2026-20315, CVE-2026-20317, CVE-2026-20231 and CVE-2026-20318 are in the hardening advisory; the first two require no privileges. The available advisory does not list a fixed version for Secure Workload, so confirm the patched release with Cisco.
3. Splunk Enterprise: update to the fixed trains. For CVE-2026-76310 and CVE-2026-76311, the fixed versions are 10.4.2, 10.2.6, 10.0.9 and 9.4.14. For CVE-2026-76312, the fixed versions are 10.4.1, 10.2.6, 10.0.9 and 9.4.14. Treat embedded-report token exposure as an integrity and data-access issue.
4. Splunk MCP Server app: update to 1.2.1 for CVE-2026-76404; this addresses an admin-role remote code execution path.
5. Then move through the remaining high-severity items: there are 42 high CVEs in this release, mainly across Splunk Enterprise, Splunk SOAR, Splunk AI Toolkit, Splunk Connect for Kafka and Splunk Enterprise Security. Follow with the 66 medium and 5 low findings during your normal patch cycle.

Beyond the patch

Monthly Cisco weeks like this are manageable when the pre-authentication and access-control items are already mapped to exposed assets. Implementation & Assessment Services can test whether the Crosswork, Secure Workload and Splunk embedded-report paths are reachable and whether the fixes close the flaws, while Virtual CISO Services (vCISO) keeps the resulting patch order visible to leadership from one month to the next.