Security Hardening Release for Splunk SOAR - August 2026

CVE-2026-76356: Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker in the Splunk documentation.

Bug ID: VULN-81538

CWE: CWE-290

CVSSv3.1 Score: 8.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Acknowledgments: NgocKhanh, CyStack

CVE-2026-76357: Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Splunk SOAR (On-premises) security information in the Splunk documentation.

Bug ID: VULN-71098

CWE: CWE-22

CVSSv3.1 Score: 7.6, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Acknowledgments: Brandon Rossi (conda)

CVE-2026-76358: Path Traversal through App Installation Tar Extraction in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) in the Splunk documentation.

Bug ID: VULN-71282

CWE: CWE-22

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76359: Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer’s archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder credentials-package extraction workflow does not verify that each archive member remains within the intended destination before extraction. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Configure forwarders to send SOAR data to your Splunk deployment in the Splunk documentation.

Bug ID: VULN-71412

CWE: CWE-22

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76360: Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Monitor the health of your Splunk SOAR (On-premises) system in the Splunk documentation.

Bug ID: VULN-71283

CWE: CWE-862

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76361: Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user with the “Administrator” role could use the /rest/support/connectivity/…/check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) in the Splunk documentation.

Bug ID: VULN-71290

CWE: CWE-918

CVSSv3.1 Score: 2.7, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76362: Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization’s credentials with a password vault in the Splunk documentation.

Additional Solution

For existing CyberArk REST credential-manager configurations, turn on Verify server certificate after upgrading.

Bug ID: VULN-82074

CWE: CWE-295

CVSSv3.1 Score: 7.4, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-76363: Structured Query Language Injection through the REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the “Automation Engineer” role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization. For more information see Manage roles and permissions in Splunk SOAR Cloud in the Splunk documentation.

Bug ID: VULN-83244

CWE: CWE-943

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2026-76364: Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the “Automation Engineer” Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) in the Splunk documentation.

Bug ID: VULN-83290

CWE: CWE-89

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2026-76365: Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the “Automation Engineer” Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on all relevant data stored in the Splunk SOAR database. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR and Create custom lists for use in Splunk SOAR playbook comparisons in the Splunk documentation.

Bug ID: VULN-83408

CWE: CWE-74

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2026-76366: Information Disclosure through the REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook in the Splunk documentation.

Bug ID: VULN-83480

CWE: CWE-200

CVSSv3.1 Score: 6.5, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE-2026-76367: Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the “Incident Commander” Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the “Incident Commander” Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) in the Splunk documentation.

Bug ID: VULN-86586

CWE: CWE-79

CVSSv3.1 Score: 4.0, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

CVE-2026-76368: Missing Authorization through Playbooks in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returning playbook revision metadata. For more information see Manage roles and permissions in Splunk SOAR (Cloud) and Manage settings for a playbook in Splunk SOAR (Cloud) in the Splunk documentation.

Bug ID: VULN-83481

CWE: CWE-862

CVSSv3.1 Score: 2.7, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CVE-2026-76369: Path Traversal through Automation Broker in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) and About Splunk SOAR Automation Broker in the Splunk documentation.

Bug ID: VULN-86558

CWE: CWE-22

CVSSv3.1 Score: 2.7, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CVE-2026-76370: Information Disclosure through the REST API in Splunk SOAR

Description

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions and Configure multiple tenants on your Splunk SOAR (On-premises) instance in the Splunk documentation.

Bug ID: VULN-72006

CWE: CWE-863

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Acknowledgments: Gabriel Nitu, Splunk